CVE-2023-50378 Apache Ambari: Various XSS problems

What is CVE-2023-50378?

CVE-2023-50378 is a medium-severity cross-site scripting vulnerability in Apache Ambari, published on 1 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8  

 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads.

Users are recommended to upgrade to version 2.7.8 which fixes this issue.

Weakness: CWE-79

Which versions are affected by CVE-2023-50378?

2 open source packages ship an affected version, including org.apache.ambari:ambari. It affects 1 product.

Products include Apache Ambari.

How do I fix CVE-2023-50378?

Upgrade org.apache.ambari:ambari to 2.7.8 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-50378 being exploited?

There is no known exploitation of CVE-2023-50378 in the wild and no public exploit code.

Other vulnerabilities in Apache Ambari

• CVE-2017-5642 Misconfiguration in Apache Ambari Critical 9.8
• CVE-2014-3582 Command injection in n/a Critical 9.8
• CVE-2016-6807 Apache Ambari Improper Access Control Critical 9.8
• CVE-2024-51941 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts High 8.8
• CVE-2025-23196 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9q6v-rxmw-g3gh.