CVE-2015-3270 Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords.

MediumCVSS 6.5 EPSS 2.7%

Published: 2015-11-02 21:00
Updated: 2026-06-17 03:25
Exploit status: No public exploit known

Description

Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords.

Affected products

Product	Affected versions	Fixed in
apache ambari	= 1.7.0	No fix listed
apache ambari	= 2.0.0	No fix listed
apache ambari	= 2.0.1	No fix listed
apache ambari	= 2.1.0	No fix listed

References

[oss-security] 20151013 [CVE-2015-3270] A non-administrative user can escalate themselves to have administrative privileges remotely mailing-list
cwiki.apache.org vendor-advisory

CVSS v2.0

6.5 Medium

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Low
Authentication: Single
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 2.72% (percentile 86.3)
CWE: CWE-264

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.