CVE-2016-6807
Apache Ambari Improper Access Control
9.8
CRITICAL
CVSS 3.1
EPSS 0.84%
Description
Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.
How to fix CVE-2016-6807
To remediate CVE-2016-6807, upgrade the affected package to a fixed version below.
- —upgrade to 2.4.2 or later
Is CVE-2016-6807 being exploited?
Low — EPSS is 0.8%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 2.4.0, < 2.4.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |