CVE-2015-1775 Apache Ambari SSRF Vulnerability
Authenticated attackers can exploit SSRF in Apache Ambari to scan ports and access unsecured internal services via crafted REST calls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1775?
CVE-2015-1775 is a medium-severity server-side request forgery vulnerability in n/a, published on 2 Nov 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
Which versions are affected by CVE-2015-1775?
2 open source packages ship an affected version, including org.apache.ambari:ambari. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.ambari:ambari Maven | From 1.5.0 | 2.1.0 |
org.apache.ambari:ambari Maven | From 1.5.0 | 2.1.0 |
Products include Apache Ambari.
How do I fix CVE-2015-1775?
Upgrade org.apache.ambari:ambari to 2.1.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2015-1775 being exploited?
There is no known exploitation of CVE-2015-1775 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-5642 Misconfiguration in Apache Ambari
- CVE-2014-3582 Command injection in n/a
- CVE-2016-6807 Apache Ambari Improper Access Control
- CVE-2024-51941 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts
- CVE-2025-23196 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition
Sources
Also known as GHSA-9g2j-5685-h44h.