In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files.
References
Link | Resource |
---|---|
https://mail-archives.apache.org/mod_mbox/ambari-user/202102.mbox/%3CCAEJYuxEQZ_aPwJdAaSxPu-Dva%3Dhc7zZUx3-pzBORbd23g%2BGH1A%40mail.gmail.com%3E | Exploit Mailing List Vendor Advisory |
https://mail-archives.apache.org/mod_mbox/ambari-user/202102.mbox/%3CCAEJYuxEQZ_aPwJdAaSxPu-Dva%3Dhc7zZUx3-pzBORbd23g%2BGH1A%40mail.gmail.com%3E | Exploit Mailing List Vendor Advisory |
Configurations
History
21 Nov 2024, 05:02
Type | Values Removed | Values Added |
---|---|---|
References | () https://mail-archives.apache.org/mod_mbox/ambari-user/202102.mbox/%3CCAEJYuxEQZ_aPwJdAaSxPu-Dva%3Dhc7zZUx3-pzBORbd23g%2BGH1A%40mail.gmail.com%3E - Exploit, Mailing List, Vendor Advisory |
Information
Published : 2021-03-17 09:15
Updated : 2024-11-21 05:02
NVD link : CVE-2020-13924
Mitre link : CVE-2020-13924
CVE.ORG link : CVE-2020-13924
JSON object : View
Products Affected
apache
- ambari
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')