XML External Entity Vulnerability in Apache Ambari and Oozie
CVE-2025-23195

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Ambari
Vendor
CVE Published:
21 January 2025

Summary

An XML External Entity (XXE) vulnerability in the Apache Ambari and Oozie projects allows attackers to inject malicious XML entities. This security weakness arises from the insecure parsing of XML input using the DocumentBuilderFactory class without properly disabling external entity resolution. By exploiting this flaw, attackers can gain access to arbitrary files on the server and potentially execute server-side request forgery (SSRF) attacks. The issue has been remediated in Ambari version 2.7.9, as well as in the trunk branch.

Affected Version(s)

Apache Ambari 0 < 2.7.9

References

https://lists.apache.org/thread/hsb6mvxd7g37dq1ygtd0pd88g...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.