CVE-2022-45855

2023-07-1210:15:09

Google

osv.dev

apache ambari

springel injection

vulnerability

upgrade

8.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.0%

JSON

SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

CPENameOperatorVersion
ambarieqrelease-2.7.4-rc0
ambarieqrelease-2.7.3-rc1
ambarieqrelease-2.7.4
ambarieqrelease-2.7.1-rc0
ambarieqrelease-2.7.5-rc0
ambarieqrelease-2.7.5
ambarieqrelease-2.7.6-rc0
ambarieqrelease-2.7.6-rc1
ambarieqrelease-2.7.3
ambarieqrelease-2.7.3-rc2

Name	Operator	Version
ambari	eq	release-2.7.4-rc0
ambari	eq	release-2.7.3-rc1
ambari	eq	release-2.7.4
ambari	eq	release-2.7.1-rc0
ambari	eq	release-2.7.5-rc0
ambari	eq	release-2.7.5
ambari	eq	release-2.7.6-rc0
ambari	eq	release-2.7.6-rc1
ambari	eq	release-2.7.3
ambari	eq	release-2.7.3-rc2