PT-2023-14783

CVE-2022-45855

·

Publicado

2023-07-11

·

Atualizado

2023-07-20

Descrição por

CVSS 3.1
8.8
Alta
MétricasAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Ambari versions 2.7.0 through 2.7.6
Description The issue allows a malicious authenticated user to execute arbitrary code remotely due to SpringEL injection in the metrics source. Users are recommended to upgrade to version 2.7.7 to resolve the issue.
Recommendations For Apache Ambari versions 2.7.0 through 2.7.6, upgrade to version 2.7.7 to fix the issue.
Explorabilidade
Correção
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (\'Expression Language Injection\')
Identificadores relacionados
CVE-2022-45855
GHSA-P7W2-784M-QPQ9
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com