| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.oozie:oozie-core | ≥ 3.1.3, < 5.0.0 | 5.0.0 |
| oozie | = 3.1.2= 3.1.3= 3.2= 3.2.0= 3.3.0= 3.3.1= 3.3.2= 4.0.0= 4.0.1= 4.1.0= 4.2.0= 4.3.0= 5.0.0 |
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free