CVE-2023-50379 Apache Ambari: authenticated users could perform command injection to perform RCE

What is CVE-2023-50379?

CVE-2023-50379 is a high-severity command injection vulnerability in Apache Ambari, published on 27 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue.

Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host.

Weakness: CWE-94

Which versions are affected by CVE-2023-50379?

2 open source packages ship an affected version, including org.apache.ambari.contrib.views:ambari-contrib-views. It affects 1 product.

Products include Apache Ambari.

How do I fix CVE-2023-50379?

Upgrade org.apache.ambari.contrib.views:ambari-contrib-views to 2.7.8 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-50379 being exploited?

There is no known exploitation of CVE-2023-50379 in the wild and no public exploit code.

Other vulnerabilities in Apache Ambari

• CVE-2017-5642 Misconfiguration in Apache Ambari Critical 9.8
• CVE-2014-3582 Command injection in n/a Critical 9.8
• CVE-2016-6807 Apache Ambari Improper Access Control Critical 9.8
• CVE-2024-51941 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts High 8.8
• CVE-2025-23196 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rghc-9fhx-h32m.