In short
- CVE-2017-15712 is a MEDIUM (CVSS 6.5) vulnerability affecting org.apache.oozie:oozie-core, oozie (apache).
- Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.8% of all vulnerabilities.
- Fix: update to 5.0.0 or later.
| Package | Affected versions | Patched versions |
|---|
| org.apache.oozie:oozie-core Maven | ≥ 3.1.3, < 5.0.0
| 5.0.0
|
| oozie | = 3.1.2= 3.1.3= 3.2= 3.2.0= 3.3.0= 3.3.1= 3.3.2= 4.0.0= 4.0.1= 4.1.0= 4.2.0= 4.3.0= 5.0.0
| No fix yet |
Description
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
NVD description
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
More vulnerabilities in org.apache.oozie:oozie-core
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free