title: Apache Ambari: authenticated users could perform command injection to perform RCE
description: Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue.
Impact:
A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.
problem types: CWE-94 Improper Control of Generation of Code ('Code Injection')
affected:
{
defaultStatus: unaffected
product: Apache Ambari
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 2.7.7, status: affected, version: 2.7.0, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]