GCVE - cpe:2.3:a:cloudera:hue:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cloudera:hue:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cloudera (`0dd05bd6-3317-576d-8018-22703a842a4f`)
Product	Hue (`3d38cef3-f99e-58ba-a28a-dca472f21d66`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/cloudera/hue`	purl2cpe	2026-06-01 10:18:08.363727

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-3884`	vulnerable	2026-06-08 07:23:10.080670	Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability HIGH (7.5) Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cloudera Hue. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Ace Editor web application. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-24332. Published: 2025-05-22T00:49:29.032Z Updated: 2025-05-22T15:53:37.932Z Open on db.gcve.eu Reference links https://www.zerodayinitiative.com/advisories/ZDI-25-250/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-4947`	vulnerable	2026-06-08 05:07:55.689376	Details available Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete. Published: 2017-03-07T16:00:00.000Z Updated: 2024-08-06T00:46:39.905Z Open on db.gcve.eu Reference links http://2016.hack.lu/archive/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf http://www.securityfocus.com/bid/93880	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-4946`	vulnerable	2026-06-08 05:07:55.688964	Details available Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2) Last name field in the HUE Users page. Published: 2017-03-07T16:00:00.000Z Updated: 2024-08-06T00:46:39.906Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/93881 http://2016.hack.lu/archive/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8094`	vulnerable	2026-06-08 05:07:03.125611	Details available Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter. Published: 2018-05-22T18:00:00.000Z Updated: 2024-08-06T08:13:31.041Z Open on db.gcve.eu Reference links https://issues.cloudera.org/browse/HUE-3626 http://cloudera.github.io/hue/latest/release-notes/release-notes-3.10.0.html https://github.com/cloudera/hue/pull/346 https://www.harmfultrust.com/p/advisories.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.