AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ambariGHSA-9q6v-rxmw-g3gh

Apache Ambari: Various Cross site scripting problems

ambari

CVE-2023-50378 · Published Mar 1, 2024 · updated Oct 3, 2024

Medium6.1
Fix: upgrade to 2.7.8 or later
GitHub advisory

Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8  

 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads.

Users are recommended to upgrade to version 2.7.8 which fixes this issue.

Affected versions

PackageAffectedFixed in
org.apache.ambari:ambari
Maven
< 2.7.82.7.8
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-20, CWE-79
Also known as
CVE-2023-50378

More ambari advisories

All ambari
High 8.8Jul 12, 2023Apache Ambari Expression Language Injection vulnerabilityCVE-2022-42009fixed in 2.7.7High 8.8Jul 12, 2023Apache Ambari Expression Language Injection vulnerabilityCVE-2022-45855fixed in 2.7.7MediumMay 17, 2022Apache Ambari SSRF VulnerabilityCVE-2015-1775fixed in 2.1.0MediumMay 17, 2022Apache Ambari Open RedirectCVE-2015-5210fixed in 2.1.2Medium 5.5May 17, 2022Apache Ambari reveals administrator passwordsCVE-2016-4976fixed in 2.4.0Critical 9.8May 17, 2022Apache Ambari Improper Access ControlCVE-2016-6807fixed in 2.4.2