medium6.5
CVE-2017-15712
Path Traversal in Apache Oozie
Impact
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.oozie:oozie-core | >= 3.1.3, < 5.0.0 | 5.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Oozie | Versions 3.1.2, 3.1.3, 3.2, 3.2.0, 3.3.0, 3.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.securityfocus.com/bid/103102
- https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E
- https://github.com/advisories/GHSA-2fx6-r6qx-3c7h
- https://nvd.nist.gov/vuln/detail/CVE-2017-15712
- https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216@%3Cdev.oozie.apache.org%3E