CVE-2022-42009 — Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.

CVE-2022-42009

Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application. PUBLISHED

Description (CNA)

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Ambari	affected 2.7.0 through 2.7.6

CWE

CWE-917

References

https://lists.apache.org/thread/6xf477ttz1oxmg0bx0tpdoz2mlqd7sbc

ADP enrichment

CVE

No English description supplied.

https://lists.apache.org/thread/6xf477ttz1oxmg0bx0tpdoz2mlqd7sbc

CISA-ADP

No English description supplied.

No references supplied.