CVE-2025-3884
Published: 22 May 2025
Summary
CVE-2025-3884 is a high-severity Path Traversal (CWE-22) vulnerability in Cloudera Hue. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Cloudera Hue contains a directory traversal vulnerability in its Ace Editor web application that permits remote attackers to disclose sensitive information on affected installations. The flaw stems from insufficient validation of user-supplied paths before they are used in file operations, classified under CWE-22, and carries a CVSS 3.0 score of 7.5 reflecting network-accessible exploitation without authentication.
Unauthenticated remote attackers can leverage the issue to read arbitrary files in the context of the service account by submitting crafted paths to the Ace Editor component. This allows disclosure of sensitive data without any prior credentials or user interaction.
The referenced Zero Day Initiative advisory ZDI-25-250 addresses the vulnerability as ZDI-CAN-24332 but provides no further mitigation details in the available information. The associated EPSS score has remained flat at 0.1184 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16094
Vulnerability details
Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cloudera Hue. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Ace Editor…
more
web application. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-24332.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.