VYPR
← All advisories
High severity7.5NVD Advisory· Published Jan 21, 2025· Updated Jun 17, 2026

CVE-2025-23195

CVE-2025-23195

Description

An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can exploit this vulnerability to read arbitrary files on the server or perform server-side request forgery (SSRF) attacks. The issue has been fixed in both Ambari 2.7.9 and the trunk branch.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Apache/Ambari2 versions
    cpe:2.3:a:apache:ambari:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:ambari:*:*:*:*:*:*:*:*range: <2.7.9
    • (no CPE)range: <2.7.9
  • Apache Software Foundation/Apache Ambariv5
    Range: 0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.