PT-2018-18373 · Apache · Apache Ambari

Publicado 2018-05-03 · Atualizado 2018-06-13 · CVE-2018-8003

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Ambari versions 1.4.0 to 2.6.1

Description: The issue allows an unauthenticated user to perform a directory traversal attack, granting read-only access to any file on the host's filesystem that is accessible by the user running the Ambari Server. This requires direct network access to the Ambari Server. Servers protected by a firewall or in a restricted network zone are at lower risk.

Recommendations: For Apache Ambari versions 1.4.0 to 2.6.1, restrict direct network access to the Ambari Server, and consider placing it behind a firewall or in a restricted network zone to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-8003

Produtos afetados

Apache Ambari

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-8003 · Nota de Segurança
• http://securityfocus.com/bid/104161 · Nota
• https://osv.dev/vulnerability/CVE-2018-8003 · Aviso do Fabricante
• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-CVE-2018-8003 · Aviso do Fabricante