GitHub Advisoryadvisory · Maven

GHSA-rghc-9fhx-h32m Apache Ambari: authenticated users could perform command injection to perform RCE

HIGH Published 2024-02-27 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-50379
Ecosystem
Maven
Packages
org.apache.ambari.contrib.views:ambari-contrib-views
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-03-01

Affected packages

• Maven org.apache.ambari.contrib.views:ambari-contrib-views: >= 2.7.0, < 2.7.8 → fixed in 2.7.8

Description

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.

Related

Alias · CVE (1)

  • CVE-2023-50379 Malicious code injection in Apache Ambari in prior to 2.7.8. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References