Advisoriesby IbisambariGHSA-q7q9-w24q-cpgh
Cross-site Scripting (XSS) in Apache Ambari Views
Fix: upgrade to 2.7.4 or later
A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.ambari:ambari Maven | < 2.7.4 | 2.7.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2020-1936
- nvd.nist.gov/vuln/detail/CVE-2020-1936
- github.com/apache/ambari/pull/3040
- github.com/apache/ambari/pull/3040/commits/a9cfdb9dcce63a3494c07c81ebb2cf8da218a210
- issues.apache.org/jira/browse/AMBARI-25329
- lists.apache.org/thread.html/946a9d72e664ad8bc592168d9a2fed88100c6e9f1bdfea08e91a3184%40%3Cuser.ambari.apache.org%3E
- www.openwall.com/lists/oss-security/2021/03/02/1
More ambari advisories
All ambari
Apache Ambari Expression Language Injection vulnerabilityCVE-2022-45855fixed in 2.7.7Apache Ambari Expression Language Injection vulnerabilityCVE-2022-42009fixed in 2.7.7Apache Ambari Open RedirectCVE-2015-5210fixed in 2.1.2Apache Ambari SSRF VulnerabilityCVE-2015-1775fixed in 2.1.0Apache Ambari reveals administrator passwordsCVE-2016-4976fixed in 2.4.0Apache Ambari Improper Access ControlCVE-2016-6807fixed in 2.4.2