{"id":"CVE-2016-6807","aliases":["EUVD-2022-4297","GHSA-j76q-99x2-v7vq"],"status":"published","title":"Apache Ambari Improper Access Control","description":"Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02446,"percentile":0.84443,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2017-03-28T20:00:00Z","modified":"2026-10-24T10:30:42Z","fixes":[{"ecosystem":"Maven","package":"org.apache.ambari:ambari","fixed_in":["2.4.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.ambari:ambari","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.ambari:ambari","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.2"}]}]}],"products":[{"vendor":"apache","product":"ambari"},{"vendor":"apache software foundation","product":"apache ambari"}],"references":[{"url":"http://www.securityfocus.com/bid/97184","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.2","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6807","tags":["advisory"]},{"url":"https://web.archive.org/web/20200227181557/http://www.securityfocus.com/bid/97184","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j76q-99x2-v7vq"},{"url":"https://github.com/apache/ambari","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2016-6807","description":"Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.","status":"published","published":"2017-03-28T20:00:00Z","modified":"2024-08-06T01:43:37.895Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2022-4297","description":"Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.","status":"published","published":"2017-03-28T20:00:00Z","modified":"2024-08-06T01:43:37Z","updated_at":"2026-11-03T02:22:35.048987Z"}],"ghsa":[{"id":"GHSA-j76q-99x2-v7vq","title":"Apache Ambari Improper Access Control","description":"Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.","status":"published","published":"2022-05-17T02:51:56Z","modified":"2023-11-07T17:56:12Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:15.931647Z"}],"nvd":[{"id":"CVE-2016-6807","description":"Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.","status":"published","published":"2017-03-28T20:59:00.17Z","modified":"2026-06-17T00:51:48.373Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"CVE-2016-6807","description":"Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.","status":"published","published":"2017-03-28T20:59:00.17Z","modified":"2026-10-24T10:30:42.37940725Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"GHSA-j76q-99x2-v7vq","title":"Apache Ambari Improper Access Control","description":"Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.","status":"published","published":"2022-05-17T02:51:56Z","modified":"2023-11-08T03:58:33.65021Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}