CVE-2016-6807

CWE-284 — Improper Access Control4 documents4 sources
Severity
9.8CRITICAL
EPSS
0.8%
top 25.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AmbariApache Ambari
Timeline
PublishedMar 28
Latest updateMay 17

Description

Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Mavenorg.apache.ambari:ambari2.4.0 — 2.4.2
▶NVDapache/ambari2.4.0, 2.4.1+1
▶CVEListV5apache_software_foundation/apache_ambari2.4.x before 2.4.2

🔴Vulnerability Details

3
GHSA
Apache Ambari Improper Access Control↗2022-05-17
▶
OSV
Apache Ambari Improper Access Control↗2022-05-17
▶
CVEList
CVE-2016-6807: Custom commands may be executed on Ambari Agent (2↗2017-03-28
▶