ambariGHSA-q7q9-w24q-cpgh
Cross-site Scripting (XSS) in Apache Ambari Views
Medium6.1CVE-2020-1936 · Published Jan 6, 2022 · updated Nov 8, 2023
A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.ambari:ambari Maven | < 2.7.4 | 2.7.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2020-1936
- nvd.nist.gov/vuln/detail/CVE-2020-1936
- github.com/apache/ambari/pull/3040
- github.com/apache/ambari/pull/3040/commits/a9cfdb9dcce63a3494c07c81ebb2cf8da218a210
- issues.apache.org/jira/browse/AMBARI-25329
- lists.apache.org/thread.html/946a9d72e664ad8bc592168d9a2fed88100c6e9f1bdfea08e91a3184%40%3Cuser.ambari.apache.org%3E
- www.openwall.com/lists/oss-security/2021/03/02/1
More ambari advisories
All ambari| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 122023 | Apache Ambari Expression Language Injection vulnerability High8.8Jul 12, 2023 | High8.8 | 2.7.7 |
| Jul 122023 | Apache Ambari Expression Language Injection vulnerabilityHigh8.8Jul 12, 2023 | High8.8 | 2.7.7 |
| May 172022 | Apache Ambari Open RedirectMediumMay 17, 2022 | Medium | 2.1.2 |
| May 172022 | Apache Ambari SSRF VulnerabilityMediumMay 17, 2022 | Medium | 2.1.0 |
| May 172022 | Apache Ambari reveals administrator passwordsMedium5.5May 17, 2022 | Medium5.5 | 2.4.0 |
| May 172022 | Apache Ambari Improper Access ControlCritical9.8May 17, 2022 | Critical9.8 | 2.4.2 |