Moderate severityNVD Advisory· Published Dec 19, 2018· Updated Aug 5, 2024

CVE-2018-11799

Description

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.oozie:oozie-coreMaven	< 5.1.0	5.1.0

Affected products

ghsa-coords
pkg:maven/org.apache.oozie/oozie-core
Range: < 5.1.0
Apache Software Foundation/Apache Ooziev5
Range: Apache Oozie 3.1.3-incubating to 5.0.0

Patches

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-wg5w-vv93-3f7wghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2018-11799ghsaADVISORY
www.securityfocus.com/bid/106266ghsavdb-entryx_refsource_BIDWEB
lists.apache.org/thread.html/347e7a8cb86014b7ca37e49eb00b8d088203bdc0bcfb4799f8e5955a%40%3Cuser.oozie.apache.org%3Emitrex_refsource_MISC
lists.apache.org/thread.html/347e7a8cb86014b7ca37e49eb00b8d088203bdc0bcfb4799f8e5955a@%3Cuser.oozie.apache.org%3EghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000