{"id":"CVE-2018-11767","aliases":["EUVD-2019-0370","GHSA-5cf4-jqwp-584g"],"status":"published","title":"Improper Privilege Management in org.apache.hadoop:hadoop-main","description":"In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.","severity":{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03726,"percentile":0.89883,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2019-03-18T13:41:17Z","modified":"2026-10-24T10:31:06Z","fixes":[{"ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","fixed_in":["2.7.7","2.8.5","2.9.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.5"},{"fixed":"2.7.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.3"},{"fixed":"2.8.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.5"},{"fixed":"2.7.7"}]}],"versions":["2.7.5","2.7.6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.3"},{"fixed":"2.8.5"}]}],"versions":["2.8.3","2.8.4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.hadoop:hadoop-main","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}],"versions":["2.9.0","2.9.1"]}],"products":[{"vendor":"apache","product":"hadoop"},{"vendor":"apache software foundation","product":"apache hadoop"}],"references":[{"url":"https://lists.apache.org/thread.html/5fb771f66946dd5c99a8a5713347c24873846f555d716f9ac17bccca%40%3Cgeneral.hadoop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/246cf223e7dc0c1dff90b78dccb6c3fe94e1a044dbf98e2333393302%40%3Ccommon-issues.hadoop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/5a44590b4eedc5e25f5bd3081d1631b52c174b5b99157f7950ddc270%40%3Ccommon-dev.hadoop.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0009/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11767","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5cf4-jqwp-584g","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/246cf223e7dc0c1dff90b78dccb6c3fe94e1a044dbf98e2333393302@%3Ccommon-issues.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/5a44590b4eedc5e25f5bd3081d1631b52c174b5b99157f7950ddc270@%3Ccommon-dev.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/5fb771f66946dd5c99a8a5713347c24873846f555d716f9ac17bccca@%3Cgeneral.hadoop.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190416-0009","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-11767","description":"In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.","status":"published","published":"2019-03-18T13:41:17Z","modified":"2024-08-05T08:17:08.999Z","updated_at":"2026-11-02T14:35:09.570381Z"}],"euvd":[{"id":"EUVD-2019-0370","description":"In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.","status":"published","published":"2019-03-18T13:41:17Z","modified":"2024-08-05T08:17:08Z","updated_at":"2026-11-03T02:39:54.565302Z"}],"ghsa":[{"id":"GHSA-5cf4-jqwp-584g","title":"Improper Privilege Management in org.apache.hadoop:hadoop-main","description":"In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.","status":"published","published":"2019-03-25T16:17:32Z","modified":"2023-01-11T05:04:17Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:36:12.361159Z"}],"nvd":[{"id":"CVE-2018-11767","description":"In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.","status":"published","published":"2019-03-21T16:00:11.78Z","modified":"2026-06-17T01:36:32.913Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:04:54.21788Z"}],"osv":[{"id":"CVE-2018-11767","description":"In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.","status":"published","published":"2019-03-21T16:00:11.78Z","modified":"2026-10-24T10:31:06.368718836Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"GHSA-5cf4-jqwp-584g","title":"Improper Privilege Management in org.apache.hadoop:hadoop-main","description":"In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.","status":"published","published":"2019-03-25T16:17:32Z","modified":"2024-02-19T05:28:21.165145Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:38.213481Z"}]}}