You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@ambari.apache.org by Yusaku Sako <yu...@hortonworks.com> on 2015/10/13 03:36:05 UTC

Re: [CVE-2015-3186] Apache Ambari XSS vulnerability

Adding the correct user@ambari.apache.org list.

Yusaku

From: Yusaku Sako
Date: Monday, October 12, 2015 at 6:34 PM
To: Mark Kerzner, Yosef Kerzner, "users@ambari.apache.org<ma...@ambari.apache.org>", "dev@ambari.apache.org<ma...@ambari.apache.org>", "security@apache.org<ma...@apache.org>", "oss-security@lists.openwall.com<ma...@lists.openwall.com>", "bugtraq@securityfocus.com<ma...@securityfocus.com>"
Subject: [CVE-2015-3186] Apache Ambari XSS vulnerability

CVE-2015-3186: Apache Ambari XSS vulnerability

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected: 1.7.0 to 2.0.2

Versions Fixed: 2.1.0

Description: Ambari allows authenticated cluster operator users to specify arbitrary text as a note when saving configuration changes. This note field is rendered as is (unescaped HTML).  This exposes opportunities for XSS.

Mitigation: Ambari users should upgrade to version 2.1.0 or above.

Version 2.1.0 onwards properly HTML-escapes the note field associated with configuration changes.

Credit: Hacker Y on the Elephant Scale team.

References: https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities