Apache Ambari vulnerabilities
6 known vulnerabilities in Apache Ambari from Apache. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Apache Ambari: Improper Neutralization of Special Elements used in a Command
A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when defining alert scripts, where the script filename field is executed using `
- 7.5 High severity
Apache Ambari: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` class without disabling exte
- 8.8 High severity
Apache Ambari: Improper Control of Generation of Code
A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code. The vulnerability occurs when processing alert definitions, where malicious input can be injected into
- 8.8 High severity
Apache Ambari: Improper Control of Generation of Code
Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster
- 8.8 High severity
Apache Ambari: Improper Neutralization of Special Elements used in an Expression Language Statement
SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
- 8.8 High severity
Apache Ambari: Improper Neutralization of Special Elements used in an Expression Language Statement
SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.