You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@ambari.apache.org by Brahma Reddy Battula <br...@apache.org> on 2023/07/10 13:45:22 UTC

CVE-2022-42009: Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.

Affected versions:

- Apache Ambari 2.7.0 through 2.7.6

Description:

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

Credit:

Jecki Go (jecgo@visa.com) (finder)

References:

https://ambari.apache.org/
https://www.cve.org/CVERecord?id=CVE-2022-42009


---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@ambari.apache.org
For additional commands, e-mail: user-help@ambari.apache.org