Vulnerability Description
A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when defining alert scripts, where the script filename field is executed using `sh -c`. An attacker with authenticated access can exploit this vulnerability to inject malicious commands, leading to remote code execution on the server. The issue has been fixed in the latest versions of Ambari.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Ambari | < 2.7.9 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/70g1l5lxvko7kvhyxmtmklhhfrlon837Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/01/21/8Mailing ListVendor Advisory
FAQ
What is CVE-2025-23196?
CVE-2025-23196 is a vulnerability with a CVSS score of 8.8 (HIGH). A code injection vulnerability exists in the Ambari Alert Definition feature, allowing authenticated users to inject and execute arbitrary shell commands. The vulnerability arises when defining aler...
How severe is CVE-2025-23196?
CVE-2025-23196 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-23196?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Ambari.