Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0yZng2LXI2cXgtM2M3aM4AAXPS
Path Traversal in Apache Oozie
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
Permalink: https://github.com/advisories/GHSA-2fx6-r6qx-3c7hJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yZng2LXI2cXgtM2M3aM4AAXPS
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: over 1 year ago
CVSS Score: 6.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-2fx6-r6qx-3c7h, CVE-2017-15712
References:
- https://nvd.nist.gov/vuln/detail/CVE-2017-15712
- https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216@%3Cdev.oozie.apache.org%3E
- http://www.securityfocus.com/bid/103102
- https://github.com/advisories/GHSA-2fx6-r6qx-3c7h
Affected Packages
maven:org.apache.oozie:oozie-core
Dependent packages: 26Dependent repositories: 97
Downloads:
Affected Version Ranges: >= 3.1.3, < 5.0.0
Fixed in: 5.0.0
All affected versions: 4.1.0, 4.2.0, 4.3.0, 4.3.1
All unaffected versions: 5.0.0, 5.1.0, 5.2.0, 5.2.1