CVE-2020-13924

In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files.

Score

CVSS 3.1 7.5 High

Status

Modified - security@apache.org

Published

2021-03-17

Last modified

2025-02-13

Weaknesses

CWE-22

Affected products

• Ambari (Apache)
• Apache Ambari (Apache Software Foundation)

References

• https://mail-archives.apache.org/mod_mbox/ambari-user/202102.mbox/%3CCAEJYuxEQZ_aPwJdAaSxPu-Dva%3Dhc7zZUx3-pzBORbd23g%2…