AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ambariGHSA-p7w2-784m-qpq9

Apache Ambari Expression Language Injection vulnerability

ambari

CVE-2022-45855 · Published Jul 12, 2023 · updated Nov 8, 2023

High8.8
Fix: upgrade to 2.7.7 or later
GitHub advisory

SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

Affected versions

PackageAffectedFixed in
org.apache.ambari:ambari
Maven
>= 2.7.0, < 2.7.72.7.7
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-917
Also known as
CVE-2022-45855

More ambari advisories

All ambari
Medium 6.1Mar 1, 2024Apache Ambari: Various Cross site scripting problemsCVE-2023-50378fixed in 2.7.8High 8.8Jul 12, 2023Apache Ambari Expression Language Injection vulnerabilityCVE-2022-42009fixed in 2.7.7MediumMay 17, 2022Apache Ambari SSRF VulnerabilityCVE-2015-1775fixed in 2.1.0MediumMay 17, 2022Apache Ambari Open RedirectCVE-2015-5210fixed in 2.1.2Medium 5.5May 17, 2022Apache Ambari reveals administrator passwordsCVE-2016-4976fixed in 2.4.0Critical 9.8May 17, 2022Apache Ambari Improper Access ControlCVE-2016-6807fixed in 2.4.2