CVE-2022-45855

Apache Ambari is affected by a SpringEL injection in the metrics source, enabling a maliciously authenticated user to execute arbitrary code remotely in Ambari versions 2.7.0–2.7.6. The documented remediation is to upgrade to version 2.7.7. If your environment uses these versions, apply the upgra...

CVE-2022-42009 Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7...

CVE-2022-42009

CVE-2022-42009 describes a SpringEL injection in Apache Ambari’s server agent that allows a malicious authenticated user to execute arbitrary code remotely. Affected versions are Ambari 2.7.0–2.7.6; exploitation would occur through the server agent component, enabling remote code execution. The p...

CVE-2022-42009

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7...

CVE-2022-45855: Improper Neutralization of Special Elements used in an Expression Language Statement

SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7...

CVE-2022-42009: Improper Neutralization of Special Elements used in an Expression Language Statement

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7...

PT-2023-14783 · Apache · Apache Ambari

Name of the Vulnerable Software and Affected Versions: Apache Ambari versions 2.7.0 through 2.7.6 Description: The issue allows a malicious authenticated user to execute arbitrary code remotely due to SpringEL injection in the metrics source. Users are recommended to upgrade to version 2.7.7 to...

PT-2023-14061 · Apache · Apache Ambari

Name of the Vulnerable Software and Affected Versions: Apache Ambari versions 2.7.0 through 2.7.6 Description: The issue allows a malicious authenticated user to execute arbitrary code remotely due to SpringEL injection in the server agent. Recommendations: For Apache Ambari versions 2.7.0 throug...

Remote Code Execution (RCE)

spring-cloud-netflix-hystrix-dashboard is vulnerable to remote code execution. Lack of secure validation of request URI path allows an attacker to send a malicious request at /hystrix/monitor;user-provided data,causing execution of malicious code because path elements following hystrix/monitor ar...

Code injection in spring-cloud-netflix-hystrix-dashboard

Applications using the spring-cloud-netflix-hystrix-dashboard expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following hystrix/monitor are being evaluated ...

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

CVE-2021-22053

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

CVE-2021-22053

Applications using both "spring-cloud-netflix-hystrix-dashboard" and "spring-boot-starter-thymeleaf" expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at "/hystrix/monitor;user-provided data", the path elements...

CVE-2021-22053: Improper Control of Generation of Code

Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at /hystrix/monitor;user-provided data, the path elements following...

PT-2021-14848

Name of the Vulnerable Software and Affected Versions spring-cloud-netflix-hystrix-dashboard versions affected versions not specified Description The issue affects applications that use both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf. It exposes a way to execute code...