Apache Ambari Expression Language Injection vulnerability

ÉLEVÉE 8.8CVE-2022-42009 · GHSA-m384-pj54-5vr2 · Published 12/07/2023 · updated 17/06/2026

En bref

CVE-2022-42009 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant org.apache.ambari:ambari, ambari (apache).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 68.6% des vulnérabilités.
Correctif : mettre à jour vers 2.7.7 ou plus récent.

Package	Affected versions	Patched versions
org.apache.ambari:ambari Maven	`≥ 2.7.0, < 2.7.7`	`2.7.7`
ambari apache	`≥ 2.7.0, < 2.7.7`	`2.7.7`

Description

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

NVD description

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

References

nvd.nist.gov/vuln/detail/CVE-2022-42009 · ADVISORY
apache/ambari · PACKAGE
lists.apache.org/thread/6xf477ttz1oxmg0bx0tpdoz2mlqd7sbc · WEB

Autres vulnérabilités de org.apache.ambari:ambari

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.ambari:ambari

Maven

≥ 2.7.0, < 2.7.7

2.7.7

ambari

apache

≥ 2.7.0, < 2.7.7

2.7.7

Description

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

NVD description

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

Autres vulnérabilités de org.apache.ambari:ambari

Tout voir →