CVE-2023-50379

Apache Ambari versions prior to 2.7.8 are vulnerable to a code injection vulnerability. This flaw allows an authenticated Cluster Operator to manipulate requests by injecting malicious code, which can lead to Remote Code Execution (RCE) and the acquisition of root privileges over the cluster's ma...

CVE-2025-23195

An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project due to insecure parsing of XML input via the DocumentBuilderFactory class. Because external entity resolution is not disabled, an attacker can inject malicious XML entities to read arbitrary files on the server or perfo...

CVE-2020-1936

Summary: CVE-2020-1936 is a cross-site scripting vulnerability in Apache Ambari Views . The issue arises from unfiltered user input in the view, enabling JS injection as described across multiple references. Impact/Scope: the vulnerability is tied to Ambari Views; CVSS metrics in the public entry...

CVE-2025-23196

A code injection vulnerability exists in the Apache Ambari Alert Definition feature, affecting versions prior to 2.7.9 . The flaw occurs because the script filename field is executed using sh -c when defining alert scripts. An authenticated user can exploit this to inject and execute arbitrary sh...