Apache Ambari XML External Entity Injection Vulnerability
CVE-2023-50380

6.5MEDIUM

Key Information:

Vendor
Apache
Status
Apache Ambari
Vendor
CVE Published:
27 February 2024

Summary

XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue.

More Details:

Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation.

This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.

Affected Version(s)

Apache Ambari 2.7.0 <= 2.7.7

References

https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7c...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/02/27/6

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.