CVE-2023-50379CWE-94

Apache Ambari: authenticated users could perform command injection to perform RCE

High · published February 27, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
64.4
In the wild
Unconfirmed
What it is

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue.

Impact:

A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01064 · 64.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-02-27T08:27Z
EPSS history
Timeline
  • 27 FEB 08:27Z
    Apache Ambari: authenticated users could perform command injection to perform RCE
    cvelistv5