Information disclosure in Ambari - CVE-2016-4976
Published: March 29, 2017 / Updated: February 8, 2021
Vulnerability identifier: #VU39338
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-4976
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to gain access to sensitive information.
Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.
Affected software
Ambari
How to mitigate CVE-2016-4976
Install update from vendor's website.
Ambari - update to 2.4.0