CVE-2023-50379

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact:A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.

CVE-2020-1936

A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.

CVE-2025-23195

An XML External Entity (XXE) vulnerability exists in the Ambari/Oozieproject, allowing an attacker to inject malicious XML entities. Thisvulnerability occurs due to insecure parsing of XML input using theDocumentBuilderFactory class without disabling external entityresolution. An attacker can explo...

CVE-2025-23196

A code injection vulnerability exists in the Ambari Alert Definitionfeature, allowing authenticated users to inject and execute arbitraryshell commands. The vulnerability arises when defining alert scripts,where the script filename field is executed using sh -c. An attackerwith authenticated access...