medium6.5
CVE-2017-15712
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process.
Impact
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Oozie | Versions 3.1.2, 3.1.3, 3.2, 3.2.0, 3.3.0, 3.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/103102
- https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E
- http://www.securityfocus.com/bid/103102
- https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E