Apache Knox vulnerabilities

2 CVEs affecting Apache Knox, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-42357, published 2022-01-17.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-42357, published 2022-01-17. Medium severity, CVSS 6.1. EPSS: 2.6% chance of exploitation in the next 30 days. When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter…
• CVE-2017-5646, published 2017-05-26. Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days. For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate another user while accessing WebHDFS through Apache Knox. This may result in…