CVE-2023-50379 Apache Ambari: authenticated users could perform command injection to perform RCE

2024-02-2708:27:03

CWE-94

apache

www.cve.org

cve-2023-50379

apache ambari

command injection

rce

upgrade

cluster operator

malicious code

cluster main host

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue.

Impact:
A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Ambari",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.7.7",
        "status": "affected",
        "version": "2.7.0",
        "versionType": "semver"
      }
    ]
  }
]