CVE-2018-8003

{"id": "CVE-2018-8003", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-05-03T23:29:00.180", "references": [{"url": "http://www.securityfocus.com/bid/104161", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@apache.org"}, {"url": "https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-CVE-2018-8003", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.securityfocus.com/bid/104161", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-CVE-2018-8003", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Apache Ambari, versions 1.4.0 to 2.6.1, is susceptible to a directory traversal attack allowing an unauthenticated user to craft an HTTP request which provides read-only access to any file on the filesystem of the host the Ambari Server runs on that is accessible by the user the Ambari Server is running as. Direct network access to the Ambari Server is required to issue this request, and those Ambari Servers that are protected behind a firewall, or in a restricted network zone are at less risk of being affected by this issue."}, {"lang": "es", "value": "Apache Ambari, de la versi\u00f3n 1.4.0 a la 2.6.1, es susceptible a un ataque de salto de directorio que permite que un usuario no autenticado manipule una petici\u00f3n HTTP que proporciona acceso de solo lectura a cualquier archivo en el sistema de archivos del host en el que se ejecuta que es accesible por el usuario como el que se est\u00e1 ejecutando el servidor de Ambari. El acceso de red directo al servidor de Ambari es necesario para enviar esta petici\u00f3n; los servidores Ambari que est\u00e1n protegidos tras un firewall o en una zona de red restringida son menos propensos a verse afectados por este problema."}], "lastModified": "2024-11-21T04:13:04.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:ambari:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79055240-571C-474C-98AB-818B98C4A912", "versionEndIncluding": "2.6.1", "versionStartIncluding": "1.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}