In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host where the Ambari server executes.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:28
Type | Values Removed | Values Added |
---|---|---|
References | () https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.3 - Vendor Advisory | |
References | () https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.5.1 - Vendor Advisory |
Information
Published : 2017-05-12 21:29
Updated : 2024-11-21 03:28
NVD link : CVE-2017-5654
Mitre link : CVE-2017-5654
CVE.ORG link : CVE-2017-5654
JSON object : View
Products Affected
apache
- ambari
CWE
CWE-91
XML Injection (aka Blind XPath Injection)