ambariGHSA-p7w2-784m-qpq9
Apache Ambari Expression Language Injection vulnerability
High8.8CVE-2022-45855 · Published Jul 12, 2023 · updated Nov 8, 2023
SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.ambari:ambari Maven | >= 2.7.0, < 2.7.7 | 2.7.7 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-917
- Also known as
- CVE-2022-45855
More ambari advisories
All ambari| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 12024 | Apache Ambari: Various Cross site scripting problems Medium6.1Mar 1, 2024 | Medium6.1 | 2.7.8 |
| Jul 122023 | Apache Ambari Expression Language Injection vulnerabilityHigh8.8Jul 12, 2023 | High8.8 | 2.7.7 |
| May 172022 | Apache Ambari SSRF VulnerabilityMediumMay 17, 2022 | Medium | 2.1.0 |
| May 172022 | Apache Ambari Open RedirectMediumMay 17, 2022 | Medium | 2.1.2 |
| May 172022 | Apache Ambari reveals administrator passwordsMedium5.5May 17, 2022 | Medium5.5 | 2.4.0 |
| May 172022 | Apache Ambari Improper Access ControlCritical9.8May 17, 2022 | Critical9.8 | 2.4.2 |