Cross-site Scripting (XSS) in Apache Ambari Views

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-1936 · ADVISORY
• apache/ambari#3040 · WEB
• apache/ambari#3040 · WEB
• issues.apache.org/jira/browse/AMBARI-25329 · WEB
• lists.apache.org/thread.html/946a9d72e664ad8bc592168d9a2fed88100c6e9f1bdfea08e91a3184%40%3Cuser.ambari.apache.org%3E · WEB
• openwall.com/lists/oss-security/2021/03/02/1 · WEB

org.apache.ambari:ambari のその他の脆弱性

• CVE-2023-50378中 6.1Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8    Impact : As it will be stored XSS, Could be e…
• CVE-2022-45855高 8.8SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary …
• CVE-2022-42009高 8.8SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary co…
• CVE-2016-4976中 5.5Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive…
• CVE-2016-6807緊急 9.8Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operati…