Lucene search

Veracode Vulnerability DatabaseVERACODE:45687

HistoryFeb 29, 2024 - 5:34 a.m.

XML External Entity

2024-02-2905:34:03

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

xml external entity

apache ambari

wfmanager

oozie workflow scheduler

file reading

privilege escalation

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

org.apache.ambari.contrib.views:wfmanager is vulnerable to XML External Entity (XXE) injection. The vulnerability is due to improper validation of user input, specifically within the Oozie Workflow Scheduler, allowing for root-level file reading and privilege escalation from low-privilege users.

CPENameOperatorVersion
ambari contrib wfmanagereq2.7.3.2.19
ambari contrib wfmanagereq2.7.3.2.19

CPE	Name	Operator	Version
	ambari contrib wfmanager	eq	2.7.3.2.19
	ambari contrib wfmanager	eq	2.7.3.2.19

References

www.openwall.com/lists/oss-security/2024/02/27/6

github.com/advisories/GHSA-qrp9-23p7-g5mf

github.com/apache/ambari/commit/d9652e4611ea36208d5f748028b3a9cd980e6edb

lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32