ambariGHSA-q3pw-6vf2-66hf
Apache Ambari reveals administrator passwords
Medium5.5CVE-2016-4976 · Published May 17, 2022 · updated Feb 16, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.ambari:ambari Maven | >= 2.0.0, < 2.4.0 | 2.4.0 |
Details and references
Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.
- CVSS 3.0
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2016-4976
More ambari advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 172022 | Apache Ambari Improper Access Control CVE-2016-6807Critical9.8fixed in 2.4.2 | Critical9.8 | 2.4.2 |
| May 172022 | Apache Ambari SSRF Vulnerability CVE-2015-1775Mediumfixed in 2.1.0 | Medium | 2.1.0 |
| May 172022 | Apache Ambari Open Redirect CVE-2015-5210Mediumfixed in 2.1.2 | Medium | 2.1.2 |
| Jan 62022 | Cross-site Scripting (XSS) in Apache Ambari Views CVE-2020-1936Medium6.1fixed in 2.7.4 | Medium6.1 | 2.7.4 |
| Jul 122023 | Apache Ambari Expression Language Injection vulnerability CVE-2022-42009High8.8fixed in 2.7.7 | High8.8 | 2.7.7 |
| Jul 122023 | Apache Ambari Expression Language Injection vulnerability CVE-2022-45855High8.8fixed in 2.7.7 | High8.8 | 2.7.7 |