VULNERABILITY INTELLIGENCE
CVE-2014-3627
CVSS score5 MEDIUM
EPSS probability3.00%
CISA KEVNot currently listed
Published2014-12-05
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:P/I:N/A:N
Description
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
Weakness classification
- CWE-59: Improper Link Resolution Before File Access ('Link Following')