Overview 9 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
9matches
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
9
100.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
9
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
9
100.0%
split by
peak 2 / year
20152
No exploit published2
Medium2
not blocked2
No public exploit2
20160
20172
No exploit published2
Critical1
Medium1
not blocked2
No public exploit2
20180
20190
20200
20211
No exploit published1
Medium1
not blocked1
No public exploit1
20220
20232
No exploit published2
High2
not blocked2
No public exploit2
20242
No exploit published2
High1
Medium1
not blocked2
No public exploit2
2015201620172018201920202021202220232024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-50378 | Medium | 2024-03-01 | No exploit published | No public exploit | Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. Users are recommended to upgrade to version 2.7.8 which fixes this issue. |
| CVE-2023-50379 | High | 2024-02-27 | No exploit published | No public exploit | Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host. |
| CVE-2022-45855 | High | 2023-07-12 | No exploit published | No public exploit | SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7. |
| CVE-2022-42009 | High | 2023-07-12 | No exploit published | No public exploit | SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7. |
| CVE-2020-1936 | Medium | 2021-03-02 | No exploit published | No public exploit | A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4. |
| CVE-2016-4976 | Medium | 2017-03-29 | No exploit published | No public exploit | Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing. |
| CVE-2016-6807 | Critical | 2017-03-28 | No exploit published | No public exploit | Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process. |
| CVE-2015-5210 | Medium | 2015-11-02 | No exploit published | No public exploit | Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter. |
| CVE-2015-1775 | Medium | 2015-11-02 | No exploit published | No public exploit | Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call. |