Medium CVE-2015-1775 EUVD-2022-3368GHSA-9g2j-5685-h44h

Apache Ambari SSRF Vulnerability

Published Nov 2, 2015 · Updated Aug 6, 2024 · Assigned by redhat

Package: org.apache.ambari:ambari Ecosystem: Maven

Description

Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.ambari:ambari	>= 1.5.0, < 2.1.0	2.1.0	GHSA-9g2j-5685-h44h

References

https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities
[oss-security] 20151013 [CVE-2015-1775] Apache Ambari Server Side Request Forgery vulnerability mailing-list