Read the docs
TI-2014-02906 Aliases CVE-2014-3582GHSA-4wh4-4qwc-3jqg

In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on…

Priority MEDIUM 45CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in an Ambari cluster.

Why it matters now

EPSS 0.01592 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:ambari:*:*:*:*:*:*:*:*up to 2.2.2VulnerableApache
  • cpe:2.3:a:apache:ambari:*:*:*:*:*:*:*:* Versions up to 2.2.2 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3582
  2. 2026-10-03 Alias added: GHSA-4wh4-4qwc-3jqg

References

Advisory 1

  • TI-2016-05848 Improper access control in Apache Ambari CVSS 3.0CRITICAL 9.8
  • TI-2017-03642 During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. CVSS 3.0CRITICAL 9.8
  • TI-2025-16981 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition CVSS 3.1HIGH 8.8
  • TI-2024-34845 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts CVSS 3.1HIGH 8.8
  • TI-2023-27565 Apache Ambari: authenticated users could perform command injection to perform RCE CVSS 3.1HIGH 8.8
  • TI-2022-22657 Apache Ambari: Allows authenticated metrics consumers to perform RCE CVSS 3.1HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences