Vulnerability Description
XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation. This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Ambari | >= 2.7.0, < 2.7.8 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2024/02/27/6Mailing List
- https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/02/27/6Mailing List
- https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32Vendor Advisory
FAQ
What is CVE-2023-50380?
CVE-2023-50380 is a vulnerability with a CVSS score of 6.5 (MEDIUM). XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerabilit...
How severe is CVE-2023-50380?
CVE-2023-50380 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-50380?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Ambari.