CVE-2013-2192
Improper Authentication in Apache Hadoop
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
Exploit likelihood
What each source reports
NVD Score used
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
- Record
CVE-2013-2192- CVSS 2.0
- 3.2 Low
AV:A/AC:H/Au:N/C:P/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
- Record
CVE-2013-2192- Updated
- 2026-11-02
EUVDEUVD-2022-4856 No score
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
- Record
EUVD-2022-4856- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pxv5-5vmp-3jj4 No score
Improper Authentication in Apache Hadoop
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
- Record
GHSA-pxv5-5vmp-3jj4- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-pxv5-5vmp-3jj4 No score
Improper Authentication in Apache Hadoop
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
- Record
GHSA-pxv5-5vmp-3jj4- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.hadoop:hadoop-commonMaven |
2.0.0 to 2.0.5-alpha | 2.0.6-alpha |
org.apache.hadoop:hadoop-commonMaven |
0.23.0 up to 0.23.9 | 0.23.9 |
org.apache.hadoop:hadoop-commonMaven |
2.0.0 up to 2.0.6-alpha, plus listed versions 2.0.1-alpha2.0.2-alpha2.0.3-alpha2.0.4-alpha2.0.5-alpha |
2.0.6-alpha |
org.apache.hadoop:hadoop-commonMaven |
0.23.0 up to 0.23.9, plus listed versions 0.23.10.23.30.23.40.23.50.23.60.23.70.23.8 |
0.23.9 |
jasperreports-server-proRed Hat:rhev_manager:3 |
before 0:5.5.0-4.el6ev | 0:5.5.0-4.el6ev |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2192 is a low vulnerability (CVSS 3.2) in Apache Hadoop, published January 24, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 64th percentile. Fixed in org.apache.hadoop:hadoop-common 2.0.6-alpha.
References
rhn.redhat.com/errata/RHSA-2014-0037.html
cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
secunia.com/advisories/57915
seclists.org/fulldisclosure/2013/Aug/251
nvd.nist.gov/vuln/detail/CVE-2013-2192
Show 17 moreShow less
github.com/advisories/GHSA-pxv5-5vmp-3jj4
access.redhat.com/errata/RHSA-2014:0037
bugzilla.redhat.com/show_bug.cgi?id=873252
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0037.json
cve.org/CVERecord?id=CVE-2012-5784