CVE-2023-50378

CWE-79 — Cross-site Scripting (XSS)CWE-20 — Improper Input Validation4 documents4 sources
Severity
6.1MEDIUM
EPSS
2.1%
top 16.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache AmbariApache Software Foundation Apache Ambari
Timeline
PublishedMar 1

Description

Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. Users are recommended to upgrade to version 2.7.8 which fixes this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDapache/ambari2.7.0 — 2.7.8
▶CVEListV5apache_software_foundation/apache_ambari2.7.0 — 2.7.7

🔴Vulnerability Details

3
GHSA
Apache Ambari: Various Cross site scripting problems↗2024-03-01
▶
OSV
Apache Ambari: Various Cross site scripting problems↗2024-03-01
▶
CVEList
Apache Ambari: Various XSS problems↗2024-03-01
▶