CVE-2023-50379 Apache Ambari: authenticated users could perform command injection to perform RCE

2024-02-2708:27:03

CWE-94

apache

github.com

apache ambari

code injection

rce

upgrade

cluster operator

AI Score

7.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue.

Impact:
A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apache:ambari:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "ambari",
    "versions": [
      {
        "status": "affected",
        "version": "2.7.0",
        "versionType": "semver",
        "lessThanOrEqual": "2.7.7"
      }
    ],
    "defaultStatus": "unknown"
  }
]