cve/2021/CVE-2021-33036.md

### [CVE-2021-33036](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33036)
![](https://img.shields.io/static/v1?label=Product&message=Apache%20Hadoop&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%202.2.0%20to%202.10.1%2C%203.0.0-alpha1%20to%203.1.4%2C%203.2.0%20to%203.2.2%2C%20and%203.3.0%20to%203.3.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-24%20Path%20Traversal%3A%20'..%2Ffiledir'&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-264%20Permissions%2C%20Privileges%2C%20and%20Access%20Controls&color=brighgreen)

### Description

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon