An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0yZng2LXI2cXgtM2M3aM4AAXPS

Path Traversal in Apache Oozie

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.

Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: over 1 year ago

CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-2fx6-r6qx-3c7h, CVE-2017-15712
References: Blast Radius: 12.9

Affected Packages

Dependent packages: 26
Dependent repositories: 97
Affected Version Ranges: >= 3.1.3, < 5.0.0
Fixed in: 5.0.0
All affected versions: 4.1.0, 4.2.0, 4.3.0, 4.3.1
All unaffected versions: 5.0.0, 5.1.0, 5.2.0, 5.2.1