Skip to content

Apache Ambari XML External Entity injection

Moderate severity GitHub Reviewed Published Feb 27, 2024 to the GitHub Advisory Database • Updated Feb 27, 2024

Package

maven org.apache.ambari.contrib.views:wfmanager (Maven)

Affected versions

>= 2.7.0, < 2.7.8

Patched versions

2.7.8

Description

XML External Entity injection in Apache Ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue.

More Details:

Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation.

This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.

References

Published by the National Vulnerability Database Feb 27, 2024
Published to the GitHub Advisory Database Feb 27, 2024
Last updated Feb 27, 2024
Reviewed Feb 27, 2024

Severity

Moderate

EPSS score

0.043%
(10th percentile)

Weaknesses

CVE ID

CVE-2023-50380

GHSA ID

GHSA-qrp9-23p7-g5mf

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.