CVE-2017-5646 json
Apache Knox allows impersonation of users
published 2017-05-26 9 y ago modified 2026-06-17 4 mo ago also GHSA-g3fc-8jv4-qmmv , EUVD-2017-14734
- cvss
- 6.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in escalated privileges and unauthorized data access. While this activity is audit logged and can be easily associated with the authenticated user, this is still a serious security issue. All users are recommended to upgrade to the Apache Knox 0.12.0 release.
Patch / fix
- maven org.apache.knox:gateway-provider-identity-assertion-common 0.12.0
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 4.9 | AV:N/AC:M/Au:S/C:P/I:P/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.knox:gateway-provider-identity-assertion-common | >=0.2.0, <0.12.0 |
0.12.0 |
Affected products
- Apache Software Foundation Apache Knox
Classification
- Weakness
-
- CWE-346 Origin Validation Error
References
-
github.com
/apache/knox/commit/998dcd257dc839c9651485760da4d614c16e2ca2
web
-
mail-archives.apache.org
/mod_mbox/knox-user/201705.mbox/%3CCACRbFyjtT7QQGHUzTRdbJoySbJb7tt4BDk5-r-VRn0GB0Kgvag%40mail.gmail.com%3E
mailing-list, web, vendor-advisory
-
securityfocus.com
/bid/98739
vdb-entry, third-party-advisory
-
lists.apache.org
/thread.html/rcd6bcbcc08840d4e4bea661efe9a5ef8f6126ebbbc5bc266701d8f48%40%3Cdev.logging.apache.org%3E
mailing-list
-
nvd.nist.gov
/vuln/detail/CVE-2017-5646
advisory
-
github.com
/apache/knox
package
-
lists.apache.org
/thread.html/rcd6bcbcc08840d4e4bea661efe9a5ef8f6126ebbbc5bc266701d8f48@%3Cdev.logging.apache.org%3E
web
Sources
- CVE List CVE-2017-5646
- GitHub Advisory GHSA-g3fc-8jv4-qmmv
- NVD CVE-2017-5646
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.