CVE-2017-15712

CWE-22 — Path Traversal4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.7%
top 28.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache OozieApache Oozie
Timeline
PublishedFeb 19
Latest updateMay 14

Description

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.apache.oozie:oozie-core3.1.3 — 5.0.0
▶NVDapache/oozie13 versions+12
▶CVEListV5apache_software_foundation/apache_oozie3.1.3-incubating to 4.3.0, 5.0.0-beta1+1

🔴Vulnerability Details

3
GHSA
Path Traversal in Apache Oozie↗2022-05-14
▶
OSV
Path Traversal in Apache Oozie↗2022-05-14
▶
CVEList
CVE-2017-15712: Vulnerability allows a user of Apache Oozie 3↗2018-02-19
▶
CVE-2017-15712 (MEDIUM CVSS 6.5) | Vulnerability allows a user of Apac | cvebase.io