CVE-2022-45855 — Apache Ambari: Allows authenticated metrics consumers to perform RCE

CVE-2022-45855

Apache Ambari: Allows authenticated metrics consumers to perform RCE PUBLISHED

Description (CNA)

SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Ambari	affected 2.7.0 through 2.7.6

CWE

CWE-917

References

https://lists.apache.org/thread/302c4hwfjy9lx63jrbhcdx948pxc54l1

ADP enrichment

CVE

No English description supplied.

https://lists.apache.org/thread/302c4hwfjy9lx63jrbhcdx948pxc54l1

CISA-ADP

No English description supplied.

No references supplied.