{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-05-21T00:00:00", "descriptions": [{"lang": "en", "value": "The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-03-23T19:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "[www-announce] 20150521 CVE-2015-1772", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q%40mail.gmail.com%3E"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21969546"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html"}, {"name": "1034365", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1034365"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2015-1772", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[www-announce] 20150521 CVE-2015-1772", "refsource": "MLIST", "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q@mail.gmail.com%3E"}, {"name": "http://www-01.ibm.com/support/docview.wss?uid=swg21969546", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21969546"}, {"name": "https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html", "refsource": "CONFIRM", "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html"}, {"name": "1034365", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1034365"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:54:16.280Z"}, "title": "CVE Program Container", "references": [{"name": "[www-announce] 20150521 CVE-2015-1772", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q%40mail.gmail.com%3E"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21969546"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html"}, {"name": "1034365", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1034365"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2015-1772", "datePublished": "2015-12-21T11:00:00", "dateReserved": "2015-02-17T00:00:00", "dateUpdated": "2024-08-06T04:54:16.280Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "31342AF9-D73E-4B72-A98D-00E33A7088C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "6771B5C2-7291-4A8F-A558-679768838EAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "1875306C-CF9A-423D-9786-B880A5EAD2DB", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:hive:1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "9EFCB996-0ED9-4FFC-BB76-8742306D47B9", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:hive:1.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "0139B115-DD15-4C84-ACA9-1F0426496288", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request."}, {"lang": "es", "value": "La implementaci\u00f3n de LDAP en Apache Hive en versiones anteriores a 1.0.1 y 1.1.x en versiones anteriores a 1.1.1, como se utiliza en IBM InfoSphere BigInsights 3.0, 3.0.0.1 y 3.0.0.2 y otros productos no maneja adecuadamente la no autenticaci\u00f3n simple y las configuraciones de enlaces an\u00f3nimos, lo que permite a atacantes remotos eludir la autenticaci\u00f3n a trav\u00e9s de una petici\u00f3n LDAP manipulada."}], "id": "CVE-2015-1772", "lastModified": "2023-11-07T02:24:55.250", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2015-12-21T11:59:00.140", "references": [{"source": "secalert@redhat.com", "url": "http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q%40mail.gmail.com%3E"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21969546"}, {"source": "secalert@redhat.com", "url": "http://www.securitytracker.com/id/1034365"}, {"source": "secalert@redhat.com", "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "Hive: authentication vulnerability in HiveServer2", "id": "1293837", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1293837"}, "csaw": false, "cvss": {"cvss_base_score": "6.8", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "status": "draft"}, "cwe": "CWE-287", "details": ["The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request."], "name": "CVE-2015-1772", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:7::hypervisor", "fix_state": "Not affected", "package_name": "jasperreports-server-pro", "product_name": "Red Hat Enterprise Virtualization 3"}], "public_date": "2015-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2015-1772\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-1772\nhttps://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCAOpgucy52yzNN1FaRcxwhZmx8ZtNRjmK6V0Bxk4svAD-R1q70Q@mail.gmail.com%3E"], "threat_severity": "Important", "upstream_fix": "Apache Hive 1.0.1, Apache Hive 1.1.1, Apache Hive 1.2.0"}