CVE-2023-50380

CVE-2023-50380 describes an XML External Entity (XXE) injection in Apache Ambari (affecting versions ≤ 2.7.7) due to improper input validation in the Oozie Workflow Scheduler. The issue could allow reading arbitrary server files (root-level) and may enable privilege escalation from low-privilege ...

CVE-2023-50379

The Apache Ambari management platform is vulnerable to a code injection flaw in versions prior to 2.7.8 . A Cluster Operator can exploit this vulnerability by manipulating requests to inject malicious code, potentially leading to root privileges over the cluster's main host and the execution of a...

CVE-2023-50378

Apache Ambari prior to version 2.7.8 is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input validation and constraint enforcement. An attacker can exploit this flaw to perform unauthorized actions, including session hijacking , unauthorized data access, or the delivery of ma...

CVE-2025-23195

An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project (specifically affecting versions prior to 2.7.9 ). The flaw is caused by insecure XML parsing using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can exploit this to read arb...

CVE-2020-1936

Summary: CVE-2020-1936 is a cross-site scripting vulnerability in Apache Ambari Views . The issue arises from unfiltered user input in the view, enabling JS injection as described across multiple references. Impact/Scope: the vulnerability is tied to Ambari Views; CVSS metrics in the public entry...

CVE-2025-23196

A code injection vulnerability exists in the Ambari Alert Definition feature in Apache Ambari versions prior to 2.7.9 . The flaw occurs because the script filename field is executed using sh -c when defining alert scripts, allowing authenticated users to inject and execute arbitrary shell command...

CVE-2015-1775

Apache Ambari (1.5.0–2.0.2) is vulnerable to SSRF via the proxy endpoint api/v1/proxy. The issue allows remote authenticated users to perform port scans and access unsecured services through a crafted REST call, due to improper validation in the proxy handling. Impact details in multiple sources ...

CVE-2024-51941

A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature of Apache Ambari . The flaw occurs during the processing of alert definitions, where malicious input can be injected into the alert script execution path. This allows an authenticated user to execute arbitra...

CVE-2015-5210

CVE-2015-5210 is an open redirect vulnerability in Apache Ambari prior to 2.1.2. The issue allows remote attackers to redirect users to arbitrary websites and conduct phishing via a URL in the targetURI parameter. Affected product is Apache Ambari; the root cause is an open redirect in the handli...

CVE-2018-8003

CVE-2018-8003 affects Apache Ambari versions 1.4.0–2.6.1. The vulnerability is a directory traversal flaw that allows an unauthenticated, remote attacker to craft an HTTP request that reads files on the host filesystem accessible to the Ambari Server user. Network access to the Ambari Server is r...

CVE-2022-45855

Apache Ambari is affected by a SpringEL injection in the metrics source, enabling a maliciously authenticated user to execute arbitrary code remotely in Ambari versions 2.7.0–2.7.6. The documented remediation is to upgrade to version 2.7.7. If your environment uses these versions, apply the upgra...

CVE-2020-13924

CVE-2020-13924 affects Apache Ambari 2.6.2.2 and earlier. Malicious users can construct file names to perform directory traversal and traverse to other directories to download files, enabling a remote, unauthenticated file download vulnerability. The vulnerability is documented across multiple so...

CVE-2022-42009

CVE-2022-42009 describes a SpringEL injection in Apache Ambari’s server agent that allows a malicious authenticated user to execute arbitrary code remotely. Affected versions are Ambari 2.7.0–2.7.6; exploitation would occur through the server agent component, enabling remote code execution. The p...

CVE-2015-4940

CVE-2015-4940 affects Apache Ambari before 2.1 as used in IBM Infosphere BigInsights 4.x before 4.1, where a configuration file stores the BigSheets password in clear text. This allows a local attacker who can read the Ambari configs to obtain sensitive information. IBM’s bulletin notes that the ...

CVE-2014-3582

Affected product: Apache Ambari. Affects Ambari server handling of SSL certificate generation for hosts in a cluster (versions 1.2.0–2.2.2). Root cause (as described): the CVE-2014-3582 condition may allow arbitrary system command execution on the Ambari Server host during the certificate generat...

CVE-2016-0707

Apache Ambari CVE-2016-0707 affects the Ambari agent prior to 2.1.2. The vulnerability arises from weak permissions on the /var/lib/ambari-agent/data and /var/lib/ambari-agent/keys directories, allowing local users to read files and obtain sensitive information. The issue is documented with a fix...

CVE-2015-4928

The CVE-2015-4928 issue affects Apache Ambari 2.1 as used in IBM InfoSphere BigInsights 4.x before 4.1, where the Configs screen displays passwords in cleartext. This allows a local attacker with access to the Ambari UI to read sensitive passwords by viewing the configuration screens. IBM’s secur...

CVE-2018-8042

Affected software/versions: Apache Ambari 2.5.0–2.6.2. Vulnerability: passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services (e.g., Hive, Oozie). This constitutes an information disclosure vu...

CVE-2015-3186

Apache Ambari 1.5.0 through 2.0.2 is affected by an XSS in the note field of a configuration change. The vulnerability arises when authenticated remote cluster operators can inject arbitrary script/HTML, with impact described as partial integrity loss and no confidentiality or availability impact...

CVE-2017-5655

CVE-2017-5655 affects Apache Ambari 2.2.2–2.4.2 and 2.5.0, where sensitive data can be written to temporary files on the Ambari Server host and remain readable by any user on the host. The underlying issue is storage of sensitive data in on-disk temp files. Public references indicate remediation ...

CVE-2016-6807

Apache Ambari CVE-2016-6807 affects the Ambari Agent on 2.4.x prior to 2.4.2. The issue allows custom commands to be executed on Ambari Agent hosts without authorization, enabling unauthorized access to operations that may affect the underlying operating system. The root cause is improper access ...

CVE-2016-4976

CVE-2016-4976 affects Apache Ambari 2.x prior to 2.4.0. The issue arises from KDC administrator passwords being exposed on the kadmin command line, which can be revealed to local users via a process listing. Public sources in the connected set confirm the vulnerable component is the Ambari KDC in...

CVE-2017-5642

CVE-2017-5642 affects Apache Ambari Server during installation of versions 2.4.0–2.4.2, where Ambari Server artifacts are not created with proper ACLs. This is a design/ACL misconfiguration issue that can impact confidentiality, integrity, and availability of artifacts (per the NVD entry: CVSS ba...

CVE-2015-3270

Apache Ambari is affected by a privilege-escalation vulnerability affecting versions before 2.0.2 and 2.1.x before 2.1.1. Remote authenticated users can obtain administrative privileges via unspecified vectors (possibly related to password changes). Root cause: privilege escalation in the Ambari ...

CVE-2017-5654

Apache Ambari Hive View vulnerability (CVE-2017-5654) affects Ambari 2.4.x before 2.4.3 and 2.5.0. An authorized user of the Ambari Hive View may obtain unauthorized read access to host files where the Ambari server runs. Root cause described in sources as an XML/insjection fault enabling reads f...

CVE-2016-0731

Apache Ambari is affected by CVE-2016-0731 in the File Browser View prior to version 2.2.1. The vulnerability allows remote authenticated administrators to read arbitrary files via a file: URL in the WebHDFS URL configuration, exposing local file data. Root cause: improper handling of file: URLs ...