Apache Ambari Multiple Vulnerabilities Summary (XSS, Path Traversal, Credential Exposure)

Critical Vulnerability Summary Ambari 2.7.4 CVE-2020-1936: Cross-site Scripting Vulnerability - Severity: Medium - Affected Versions: Prior to 2.7.4 - Fixed Version: 2.7.4 - Description: Improper encoding of special characters may lead to script execution Ambari 2.7.0 CVE-2018-8042: Hadoop Credential Storage Visibility Issue - Severity: Important - Affected Versions: 2.5.x, 2.6.x - Fixed Version: 2.7.0 - Description: Passwords in credential storage are visible in informational logs Ambari 2.6.2 CVE-2018-8003: Path Traversal Vulnerability - Severity: Important - Affected Versions: 1.4.0 to 2.6.1 - Fixed Version: 2.6.2 - Description: Arbitrary file access within Ambari Server runtime directory via HTTP request Ambari 2.5.1 CVE-2017-5654: XML Injection Vulnerability in Hive View - Severity: Important - Affected Versions: 2.4.0 to 2.5.0 - Fixed Version: 2.4.3, 2.5.1 - Description: Authorized users may access files executed by Ambari server CVE-2017-5655: Sensitive Data Exposure in Ambari Temporary Directory During Configuration Download - Severity: Important - Affected Versions: 2.2 to 2.4.2 and 2.5.0 - Fixed Version: 2.4.3, 2.5.1 - Description: Sensitive data may be stored in temporary files Ambari 2.5.0 CVE-2017-5642: Incorrect ACLs for Ambari Server Artifacts - Severity: Important - Affected Versions: 2.4.0 to 2.4.2 - Fixed Version: 2.4.3, 2.5.0 - Description: Artifacts not created with proper ACLs during installation Additional Information Each vulnerability includes detailed description, severity, affected and fixed versions, mitigation measures, and discoverer information. Distributed across multiple Ambari versions, covering various fix points from 2.1.0 to 2.7.4. Involves various types of security issues, including XSS, cross-site request forgery, privilege escalation, etc.

Goal Reached Thanks to every supporter — we hit 100%!

Apache Ambari Multiple Vulnerabilities Summary (XSS, Path Traversal, Credential Exposure)