GitHub Advisoryadvisory · Maven

GHSA-qrp9-23p7-g5mf Apache Ambari XML External Entity injection

MEDIUM Published 2024-02-27 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-50380
Ecosystem
Maven
Packages
org.apache.ambari.contrib.views:wfmanager
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-611
Reviewed
2024-02-27

Affected packages

• Maven org.apache.ambari.contrib.views:wfmanager: >= 2.7.0, < 2.7.8 → fixed in 2.7.8

Description

XML External Entity injection in Apache Ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation. This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.

Related

Alias · CVE (1)

  • CVE-2023-50380 XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References