CVE-2018-11764: 
Java vulnerability analysis and mitigation

Web endpoint authentication check vulnerability (CVE-2018-11764) was discovered in Apache Hadoop versions 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. The vulnerability allows authenticated users to impersonate any user even without proxy user configuration, presenting a significant security risk for affected systems (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It is classified under CWE-306 (Missing Authentication for Critical Function). The vulnerability specifically affects the web endpoint authentication mechanism, allowing authenticated users to bypass intended authentication checks (NVD).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the affected systems (NetApp Advisory).

The vulnerability requires network access and low attack complexity, with only low privileges needed for exploitation. No user interaction is required for the attack to succeed, making it relatively straightforward to exploit for authenticated users (NVD).

Users should upgrade from the affected versions (3.0.0-alpha4, 3.0.0-beta1, and 3.0.0) to a patched version of Apache Hadoop. No specific workarounds have been publicly documented (NVD).