CVE-2013-2192
apache hadoop: no CVSS score yet. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in org.apache.hadoop:hadoop-common 0.23.9, 2.0.6-alpha.
The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:hadoop
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pxv5-5vmp-3jj4 | Maven | org.apache.hadoop:hadoop-common | >=2.0.0 <2.0.6-alpha | 2.0.6-alpha |
| GHSA-pxv5-5vmp-3jj4 | Maven | org.apache.hadoop:hadoop-common | >=0.23.0 <0.23.9 | 0.23.9 |