CVE-2022-45855: Apache Ambari: Allows authenticated metrics consumers to perform RCE
Published Jul 12, 2023
·Updated
SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
Affected Software
2 affected componentsFixes available
Apache Ambari>=2.7.0<2.7.7
maven/org.apache.ambari:ambari>=2.7.0<2.7.7
2.7.7
Event History
Jul 12, 2023
CVE Published
via MITRE·09:59 AM
Data Sourced
via MITRE·09:59 AM
DescriptionSeverityWeakness
Advisory Published
12:31 PM
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-45855.
2
What is the severity of CVE-2022-45855?
The severity of CVE-2022-45855 is high with a severity score of 8.8.
3
Who is affected by CVE-2022-45855?
Apache Ambari version 2.7.0 to 2.7.6 is affected by CVE-2022-45855.
4
How can a malicious user exploit CVE-2022-45855?
A malicious authenticated user can exploit CVE-2022-45855 to execute arbitrary code remotely.
5
How can I mitigate the risk of CVE-2022-45855?
Users are recommended to upgrade to Apache Ambari version 2.7.7 to mitigate the risk of CVE-2022-45855.