8.0
High
CVE-2022-42009 SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user…
Description
SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Ambari 2.7 | 2.7.0 → 2.7.6 | No fix stated |
| ambari 2.7 | 2.7.0 → 2.7.6 | No fix stated |
Other CVEs of Apache Ambari
The 16 CVEs of Apache Ambari →
CVE-2024-51941
A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users…
Not rated
CVE-2025-23196
A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject…
Not rated
CVE-2025-23195
An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious…
Not rated
CVE-2023-50378
Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be…
Not rated