Information disclosure in Apache Ambari
CVE-2017-5655
In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are readable by any user authenticated on the host.
Vulnerability class: Information Disclosure
EPSS: 0.021 (78.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Ambari — versions 2.2.2, 2.4.0, 2.4.1
- Apache Software Foundation Ambari — versions 2.5.0, 2.2.2 through 2.4.2
Weakness classification (CWE)
References
- security@apache.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
- security@apache.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-5655?
- CVE-2017-5655 is a medium-severity vulnerability in Apache Ambari, classified under Information Disclosure. CVSS score: 6.5/10. Published 2017-05-15.
- How severe is CVE-2017-5655?
- Medium severity. CVSS v3 base score is 6.5 out of 10.