Critical severity · published Apr 3, 2017
CVE-2017-5642
During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs
9.8
CVSS
1.9%
EPSS
No
On KEV
Description
During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Ambari · Apache
2.4.0; 2.4.1; 2.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5642
Vendor Advisory
https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.5.0
More from Ambari
9.8
CVE-2014-3582
In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in an Ambari cluster
9.8
CVE-2016-6807
Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying…
8.8
CVE-2024-51941
Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts
8.8
CVE-2025-23196
Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition
8.8
CVE-2023-50379
Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue