Known vulnerabilities in Ambari

Vendor: Apache Foundation
Software: Ambari
Software CPE: cpe:2.3:a:apache_foundation:ambari:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 20
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ambari Ambari is affected by 20 known vulnerabilities: 2 high, 12 medium, 6 low Critical High Medium Low

Vulnerabilities (20)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU105120 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-23195		 CWE-611 Medium
No
No
 2.7.9 28.02.2025 SB2025022814
#VU105116 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-51941		 CWE-78 Medium
No
No
 2.7.9 28.02.2025 SB2025022814
#VU105114 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-23196		 CWE-78 Medium
No
No
 2.7.9 28.02.2025 SB2025022814
#VU86996 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-50378		 CWE-79 Low
No
No
 2.7.8 04.03.2024 SB2024022834
#VU86902 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2023-50380		 CWE-611 Medium
No
No
 2.7.8 28.02.2024 SB2024022834
#VU86901 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-50379		 CWE-78 Medium
No
No
 2.7.8 28.02.2024 SB2024022834
#VU86017 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-45855		 CWE-94 Medium
No
No
 2.7.7 01.02.2024 SB2023071039
#VU86016 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-42009		 CWE-94 Medium
No
No
 2.7.7 01.02.2024 SB2023071039
#VU51104 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-1936		 CWE-79 Low
No
No
 2.7.4 02.03.2021 SB2021030217
#VU18665 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
 CWE-79 Medium
No
No
 2.7.0 03.06.2019 SB2019052711
#VU12423 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2018-8003		 CWE-22 Low
No
No
 2.6.2 08.05.2018 SB2018050810
#VU38991 - Exposure of sensitive information to an unauthorized actor
CVE-2017-5655		 CWE-200 Medium
No
No
 2.4.3, 2.5.1 15.05.2017 SB2017051303
#VU38996 - XML Injection
CVE-2017-5654		 CWE-91 Medium
No
No
 2.4.3, 2.5.1 13.05.2017 SB2017051303
#VU39286 - Incorrect Default Permissions
CVE-2017-5642		 CWE-276 High
No
No
 2.4.3 03.04.2017 SB2017040316
#VU39338 - Exposure of sensitive information to an unauthorized actor
CVE-2016-4976		 CWE-200 Low
No
No
 2.4.0 29.03.2017 SB2017032916
#VU39347 - Improper Access Control
CVE-2016-6807		 CWE-284 High
No
No
 2.4.2 28.03.2017 SB2017032815
#VU40613 - Improper input validation
CVE-2015-5210		 CWE-20 Low
No
No
 2.1.2 02.11.2015 SB2015110204
#VU40614 - Permissions, Privileges, and Access Controls
CVE-2015-3270		 CWE-264 Medium
No
No
 2.0.2, 2.1.1 02.11.2015 SB2015110204
#VU40615 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2015-3186		 CWE-79 Low
No
No
 2.1.0 02.11.2015 SB2015110205
#VU40616 - Improper input validation
CVE-2015-1775		 CWE-20 Medium
No
No
 2.1.0 02.11.2015 SB2015110206