Apache Ambari (Apache Software Foundation) - vulnerabilities (CVEs)
16 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2025-01-21. Vendor: Apache Software Foundation.
CVEs of Apache Ambari
- CVE-2025-23196 - CVSS 8.8 (high), 2025-01-21: A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The…
- CVE-2025-23195 - CVSS 7.5 (high), 2025-01-21: An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability…
- CVE-2024-51941 - CVSS 8.8 (high), 2025-01-21: A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code.…
- CVE-2023-50378 - CVSS 6.1 (medium), 2024-03-01: Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be stored XSS, Could be exploited to perform…
- CVE-2023-50380 - CVSS 6.5 (medium), 2024-02-27: XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details:…
- CVE-2023-50379 - CVSS 8.8 (high), 2024-02-27: Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster…
- CVE-2022-45855 - CVSS 8.8 (high), 2023-07-12: SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code…
- CVE-2022-42009 - CVSS 8.8 (high), 2023-07-12: SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users…
- CVE-2020-13924 - CVSS 7.5 (high), 2021-03-17: In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download…
- CVE-2020-1936 - CVSS 6.1 (medium), 2021-03-02: A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
- CVE-2018-8042 - CVSS 8.1 (high), 2018-07-18: Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store…
- CVE-2018-8003 - CVSS 5.3 (medium), 2018-05-03: Apache Ambari, versions 1.4.0 to 2.6.1, is susceptible to a directory traversal attack allowing an unauthenticated user to craft an HTTP request which…
- CVE-2017-5655 - CVSS 6.5 (medium), 2017-05-15: In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are…
- CVE-2017-5654 - CVSS 7.5 (high), 2017-05-12: In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host…
- CVE-2017-5642 - CVSS 9.8 (critical), 2017-04-03: During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs.
- CVE-2016-6807 - CVSS 9.8 (critical), 2017-03-28: Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may…
