PT-2021-2448 · Apache · Apache Ambari

Published 2021-03-01 · Updated 2022-01-06 · CVE-2020-1936

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Apache Ambari versions prior to 2.7.4

Description: A cross-site scripting issue was found in Apache Ambari Views. This issue may allow a remote attacker to impact the confidentiality and integrity of protected information.

Recommendations: For versions prior to 2.7.4, update to Apache Ambari 2.7.4 to resolve the issue. As a temporary workaround, consider restricting access to Apache Ambari Views until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-01813

CVE-2020-1936

GHSA-Q7Q9-W24Q-CPGH

Affected Products

Apache Ambari

References · 13

• https://lists.apache.org/thread.html/946a9d72e664ad8bc592168d9a2fed88100c6e9f1bdfea08e91a3184%40%3Cuser.ambari.apache.org%3E · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01813 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1936 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q7q9-w24q-cpgh · Vendor Advisory
• https://github.com/apache/ambari/pull/3040 · Note
• https://github.com/apache/ambari/pull/3040/commits/a9cfdb9dcce63a3494c07c81ebb2cf8da218a210 · Note
• https://t.me/cvenotify/10699 · Telegram Post
• https://t.me/cvenotify/11090 · Telegram Post
• http://openwall.com/lists/oss-security/2021/03/02/1 · Note
• https://issues.apache.org/jira/browse/AMBARI-25329 · Note
• https://t.me/cibsecurity/24333 · Telegram Post
• https://t.me/cvenotify/10706 · Telegram Post