description: The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.
problem types: XSS
affected:
{
product: Apache Hadoop
vendor: Apache Software Foundation
versions:
status: affected, version: 2.6.x and earlier
}