CVE-2016-6807
First published: Tue Mar 28 2017(Updated: )
Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Ambari | =2.4.0 | |
| Apache Ambari | =2.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/97184
- https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.2
- https://nvd.nist.gov/vuln/detail/CVE-2016-6807
- https://web.archive.org/web/20200227181557/http://www.securityfocus.com/bid/97184
- https://github.com/advisories/GHSA-j76q-99x2-v7vq (Advisory)
Frequently Asked Questions
What is the severity of CVE-2016-6807?
CVE-2016-6807 has been classified with a high severity due to the potential for unauthorized access and system manipulation.
How do I fix CVE-2016-6807?
To fix CVE-2016-6807, upgrade to Apache Ambari version 2.4.2 or later, which addresses this vulnerability.
Who is affected by CVE-2016-6807?
CVE-2016-6807 affects Apache Ambari versions 2.4.0 and 2.4.1 running on any supported operating system.
What type of vulnerability is CVE-2016-6807?
CVE-2016-6807 is a security vulnerability that allows for the execution of custom commands without proper authorization.
Can CVE-2016-6807 lead to additional security issues?
Yes, CVE-2016-6807 can potentially lead to further exploitation, as unauthorized actions on the system can create weak points for attack.
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-j76q-99x2-v7vq
- alias/CVE-2016-6807
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/tags
- agent/source
- vendor/apache
- canonical/apache ambari
- version/apache ambari/2.4.0
- version/apache ambari/2.4.1
- package-manager/maven