AM
Product
Ambari
26
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 9Medium 7Low 1
Watch
Add Ambari to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-51941 | 8.8 | Jan 21 | Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts Affected: through 2.7.8 |
| CVE-2025-23196 | 8.8 | Jan 21 | Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition Affected: before 2.7.9 |
| CVE-2023-50379 | 8.8 | Feb 27 | Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue Affected: before 2.7.8 |
| CVE-2022-45855 | 8.8 | Jul 12 | SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to… Affected: 2.7.0 before 2.7.7 |
| CVE-2022-42009 | 8.8 | Jul 12 | SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely Affected: 2.7.0 before 2.7.7 |
| CVE-2018-8042 | 8.1 | Jul 18 | Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled… Affected: 2.5.0 through 2.6.2 |
| CVE-2025-23195 | 7.5 | Jan 21 | Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie Affected: before 2.7.9 |
| CVE-2020-13924 | 7.5 | Mar 17 | In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files Affected: through 2.6.2.2 |
| CVE-2017-5654 | 7.5 | May 12 | In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host where the Ambari… Affected: 2.4.0; 2.4.1; 2.5.0 |
Showing 9