PT-2017-16649 · Apache · Ambari

Publicado 2017-05-15 · Atualizado 2017-05-23 · CVE-2017-5655

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ambari versions 2.2.2 through 2.4.2 Ambari version 2.5.0

Description The issue allows sensitive data to be stored on disk in temporary files on the Ambari Server host. These temporary files are readable by any user authenticated on the host.

Recommendations For Ambari versions 2.2.2 through 2.4.2, restrict access to the temporary files on the Ambari Server host to prevent unauthorized users from reading sensitive data. For Ambari version 2.5.0, restrict access to the temporary files on the Ambari Server host to prevent unauthorized users from reading sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-5655

Produtos afetados

Ambari

Referências · 4

• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.3 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-5655 · Aviso do Fabricante
• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.5.1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5655 · Nota de Segurança