cve.bz

CVE-2018-11766

8.8 highEPSS 3.2%

High (8.8) in apache hadoop. EPSS 3.2% chance of exploitation in the next 30 days. Fixed in org.apache.hadoop:hadoop-main 2.7.7.

In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.

Severity

CVSS 3.0

8.8 high
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-rqj9-cq6j-958rMavenorg.apache.hadoop:hadoop-main>=2.7.4 <2.7.72.7.7

References

Check your stackJSON