Description

SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

Remediation

References

https://lists.apache.org/thread/302c4hwfjy9lx63jrbhcdx948pxc54l1

Related Vulnerabilities

CVE-2017-12625 Vulnerability in maven package org.apache.hive.hcatalog:hive-hcatalog-core

CVE-2018-8038 Vulnerability in maven package org.apache.cxf.fediz:fediz-core

CVE-2022-36897 Vulnerability in maven package com.compuware.jenkins:compuware-xpediter-code-coverage

CVE-2018-1306 Vulnerability in maven package org.apache.portals.pluto:portletv3annotateddemo

CVE-2020-15841 Vulnerability in maven package com.liferay:com.liferay.portal.settings.authentication.ldap.web

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory NVD-CWE-noinfo