CVE-2022-42009 Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.
A malicious authenticated user can execute arbitrary code remotely via SpringEL injection in Apache Ambari server agent.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-42009?
CVE-2022-42009 is a high-severity code injection vulnerability in Apache Ambari, published on 12 Jul 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
Weakness: CWE-917
Which versions are affected by CVE-2022-42009?
2 open source packages ship an affected version, including org.apache.ambari:ambari. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.ambari:ambari Maven | From 2.7.0 | 2.7.7 |
org.apache.ambari:ambari Maven | From 2.7.0 | 2.7.7 |
Products include Apache Ambari.
How do I fix CVE-2022-42009?
Upgrade org.apache.ambari:ambari to 2.7.7 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-42009 being exploited?
There is no known exploitation of CVE-2022-42009 in the wild and no public exploit code.
Other vulnerabilities in Apache Ambari
- CVE-2017-5642 Misconfiguration in Apache Ambari
- CVE-2014-3582 Command injection in n/a
- CVE-2016-6807 Apache Ambari Improper Access Control
- CVE-2024-51941 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts
- CVE-2025-23196 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition
Sources
Also known as GHSA-m384-pj54-5vr2.