Login Request a demo
Medium severity · published Mar 1, 2024
CVE-2023-50378
Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8    Impact : As it will be stored XSS, Could be exploited to perform unauthorized…
6.1
CVSS
1.2%
EPSS
No
On KEV
Description
Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8    Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. Users are recommended to upgrade to version 2.7.8 which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Ambari · Apache
2.7.0 before 2.7.8 · source: NVD
Affected product
AM
Ambari
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50378
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50378
Mailing List
https://lists.apache.org/thread/6hn0thq743vz9gh283s2d87wz8tqh37c
Mailing List
http://www.openwall.com/lists/oss-security/2024/03/01/5
More from Ambari
9.8
CVE-2017-5642
During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs
9.8
CVE-2014-3582
In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in an Ambari cluster
9.8
CVE-2016-6807
Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying…
8.8
CVE-2025-23196
A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands
8.8
CVE-2024-51941
A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code