GitHub Advisoryadvisory · Maven

GHSA-wg5w-vv93-3f7w Moderate severity vulnerability that affects org.apache.oozie:oozie-core

MEDIUM Published 2018-12-20 Modified 2021-09-21 Official page ↗
Aliases
CVE-2018-11799
Ecosystem
Maven
Packages
org.apache.oozie:oozie-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• Maven org.apache.oozie:oozie-core: < 5.1.0 → fixed in 5.1.0

Description

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.

Related

Alias · CVE (1)

  • CVE-2018-11799 Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References