CVE-2015-1775 Apache Ambari SSRF Vulnerability
MediumCVSS 5.5
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.ambari/ambari(Maven) | >= 1.5.0, < 2.1.0 | 2.1.0 |
| org.apache.ambari/ambari(Maven) | = 1.7.0.0 | No fix listed |
| org.apache.ambari/ambari(Maven) | = 2.0.0.0 | No fix listed |
| apache ambari | = 1.5.0 | No fix listed |
| apache ambari | = 1.5.1 | No fix listed |
| apache ambari | = 1.6.0 | No fix listed |
| apache ambari | = 1.6.1 | No fix listed |
| apache ambari | = 1.7.0 | No fix listed |
| apache ambari | = 2.0.0 | No fix listed |
| apache ambari | = 2.0.1 | No fix listed |
| apache ambari | = 2.0.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [oss-security] 20151013 [CVE-2015-1775] Apache Ambari Server Side Request Forgery vulnerability mailing-list
- cwiki.apache.org vendor-advisory
- github.com