PT-2017-16649 · Apache · Ambari

Published 2017-05-15 · Updated 2017-05-23 · CVE-2017-5655

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ambari versions 2.2.2 through 2.4.2 Ambari version 2.5.0

Description The issue allows sensitive data to be stored on disk in temporary files on the Ambari Server host. These temporary files are readable by any user authenticated on the host.

Recommendations For Ambari versions 2.2.2 through 2.4.2, restrict access to the temporary files on the Ambari Server host to prevent unauthorized users from reading sensitive data. For Ambari version 2.5.0, restrict access to the temporary files on the Ambari Server host to prevent unauthorized users from reading sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5655

Affected Products

Ambari

References · 4

• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5655 · Vendor Advisory
• https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.5.1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5655 · Security Note