Moderate severityNVD Advisory· Published Feb 19, 2018· Updated Sep 17, 2024
CVE-2017-15712
CVE-2017-15712
Description
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.oozie:oozie-coreMaven | >= 3.1.3, < 5.0.0 | 5.0.0 |
Affected products
2- Apache Software Foundation/Apache Ooziev5Range: 3.1.3-incubating to 4.3.0
Patches
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- github.com/advisories/GHSA-2fx6-r6qx-3c7hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-15712ghsaADVISORY
- www.securityfocus.com/bid/103102ghsavdb-entryx_refsource_BIDWEB
- lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3Emitremailing-listx_refsource_MLIST
- lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216@%3Cdev.oozie.apache.org%3EghsaWEB
News mentions
0No linked articles in our index yet.