PT-2023-14783

CVE-2022-45855

·

Published

2023-07-11

·

Updated

2023-07-20

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache Ambari versions 2.7.0 through 2.7.6
Description The issue allows a malicious authenticated user to execute arbitrary code remotely due to SpringEL injection in the metrics source. Users are recommended to upgrade to version 2.7.7 to resolve the issue.
Recommendations For Apache Ambari versions 2.7.0 through 2.7.6, upgrade to version 2.7.7 to fix the issue.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (\'Expression Language Injection\')
Related identifiers
CVE-2022-45855
GHSA-P7W2-784M-QPQ9
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com