CVE-2023-50379
Assigner: apache
Published: 2024-02-27T08:27:03.120Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Ambari
vendor: Apache Software Foundation
versions: lessThanOrEqual: 2.7.7
status: affected
version: 2.7.0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: transparent;">Malicious code injection in Apache Ambari in prior to 2.7.8.&nbsp;</span><span style="background-color: transparent;"><span style="background-color: rgb(255, 255, 255);">Users are recommended to upgrade to version 2.7.8, which fixes this issue.</span></span><b><span style="background-color: transparent;"><br><br></span></b><span style="background-color: transparent;">Impact:</span><b><span style="background-color: transparent;"><br></span></b><span style="background-color: transparent;">A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.</span><br><br>
value: Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue.

Impact:
A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.


metrics: other: content: text: important
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
type: CWE
source: discovery: UNKNOWN
title: Apache Ambari: authenticated users could perform command injection to perform RCE
x_generator: engine: Vulnogram 0.1.0-dev