High severity · published Dec 21, 2015
CVE-2015-1836
Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect…
7.3
CVSS
7.4%
EPSS
No
On KEV
Description
Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HB
Hbase · Apache
0.98.0; 0.98.1; 0.98.2; 0.98.3; 0.98.4; 0.98.5; +9 more · source: NVD
IB
Infosphere Biginsights · Ibm
3.0.0.0; 3.0.0.1; 3.0.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1836
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1836
mail-archives.apache.org
http://mail-archives.apache.org/mod_mbox/www-announce/201505.mbox/%3CCA+RK=_CFiTfQ2d0V+kuJx_y5izmYccaKjXaJ3V72KK7tbOhbkg%40mail.gmail.com%3E
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21969546
www.securitytracker.com
http://www.securitytracker.com/id/1034365
www.cloudera.com
https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html
More from Hbase
8.1
CVE-2018-8025
CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP
7.5
CVE-2019-15544
An issue was discovered in the protobuf crate before 2.6.0 for Rust
7.5
CVE-2019-0212
In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server
6.5
CVE-2026-49326
Apache HBase: Missing scanner instance owner check in thrift delegation service
–
CVE-2013-2193
Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and…