Skip to content
OpenAdvisories

Package · Maven

org.apache.ambari:ambari

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 6.1
    CVE-2023-50378

    Apache Ambari: Various XSS problems

    Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8    Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payload…

    Apache Software Foundation Apache Ambari org.apache.ambari:ambari Maven
  • High 8.0
    CVE-2022-45855

    Apache Ambari: Allows authenticated metrics consumers to perform RCE

    SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

    Apache Software Foundation Apache Ambari org.apache.ambari:ambari Maven
  • High 8.0
    CVE-2022-42009

    Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.

    SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

    Apache Software Foundation Apache Ambari org.apache.ambari:ambari Maven
  • Medium 6.1
    CVE-2020-1936

    Stored XSS in Apache Ambari

    A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.

    Apache Software Foundation Apache Ambari org.apache.ambari:ambari Maven
  • Medium 5.5
    CVE-2016-4976

    Apache Ambari reveals administrator passwords

    Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.

    org.apache.ambari:ambari Maven
  • Critical 9.8
    CVE-2016-6807

    Apache Ambari Improper Access Control

    Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent host…

    Apache Software Foundation Apache Ambari org.apache.ambari:ambari Maven
  • Medium —
    CVE-2015-1775

    Apache Ambari SSRF Vulnerability

    Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.

    org.apache.ambari:ambari Maven
  • Medium —
    CVE-2015-5210

    Apache Ambari Open Redirect

    Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter.

    org.apache.ambari:ambari Maven