CVE-2025-23196
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Jan 21, 2025
Updated: Jan 22, 2025
CWE ID 77
Summary
CVE-2025-23196 is a code injection vulnerability affecting the Ambari Alert Definition feature. Authenticated users can exploit this issue by injecting arbitrary shell commands when defining alert scripts. The vulnerability arises due to the use of `sh -c` to execute the script filename. Successful exploitation leads to remote code execution on the server. This issue has been resolved in the latest releases of Ambari.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.