CVE-2025-3884

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cloudera Hue. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the Ace Editor web application. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-24332.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Cloudera	Hue	4.11.0

References

https://www.zerodayinitiative.com/advisories/ZDI-25-250/Third Party Advisory

Timeline

Published: May 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-38856.5Harman Becker MGU21 Bluetooth Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attacker CVE-2025-38868.1An issue in CatoNetworks CatoClient before v.5.8.0 allows attackers to escalate privileges and achieve a race condition (TOCTOU) via the Pri CVE-2025-38878.8GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to CVE-2025-38885.4The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and inclu CVE-2025-38895.3The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi CVE-2025-38905.4The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' short CVE-2025-38917.5A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of CVE-2025-38926.7ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be expl CVE-2025-38938.6While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provide CVE-2025-38944.8Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In order to use the ed CVE-2025-38959.1Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value. CVE-2025-38975.9The EUCookieLaw plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.7.2 via the 'file_get_cont