VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Feb 19, 2018· Updated Jun 17, 2026

CVE-2017-15712

CVE-2017-15712

Description

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.oozie:oozie-coreMaven
>= 3.1.3, < 5.0.05.0.0

Affected products

31
  • Apache Software Foundation/Apache Ooziev5
    Range: 3.1.3-incubating to 4.3.0
  • ghsa-coords
    pkg:maven/org.apache.oozie/oozie-core
    Range: >= 3.1.3, < 5.0.0
  • Apache/Oozie29 versions
    cpe:2.3:a:apache:oozie:3.1.2:*:*:*:*:*:*:*+ 28 more
    • cpe:2.3:a:apache:oozie:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.2.0:incubating:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.3.0:rc0:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.3.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.3.1:rc0:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.3.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:3.3.2:rc0:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.0.0:rc0:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.0.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.0.1:rc0:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.0.1:rc1:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.1.0:rc0:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.1.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.2.0:rc0:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.3.0:rc0:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:4.3.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:apache:oozie:5.0.0:beta1:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.