CVE-2023-50379

The Apache Ambari management platform is vulnerable to a code injection flaw in versions prior to 2.7.8 . A Cluster Operator can exploit this vulnerability by manipulating requests to inject malicious code, potentially leading to root privileges over the cluster's main host and the execution of a...

CVE-2025-23195

An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project (specifically affecting versions prior to 2.7.9 ). The flaw is caused by insecure XML parsing using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can exploit this to read arb...

CVE-2020-1936

Summary: CVE-2020-1936 is a cross-site scripting vulnerability in Apache Ambari Views . The issue arises from unfiltered user input in the view, enabling JS injection as described across multiple references. Impact/Scope: the vulnerability is tied to Ambari Views; CVSS metrics in the public entry...

CVE-2025-23196

A code injection vulnerability exists in the Ambari Alert Definition feature in Apache Ambari versions prior to 2.7.9 . The flaw occurs because the script filename field is executed using sh -c when defining alert scripts, allowing authenticated users to inject and execute arbitrary shell command...