CVE-2025-23195

published 2025-01-21

CVE-2025-23195: An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie
project, allowing an attacker to inject malicious XML entities. This
vulnerability occurs due to insecure parsing of XML input using the
`DocumentBuilderFactory` class without disabling external entity
resolution. An attacker can exploit this vulnerability to read arbitrary
files on the server or perform server-side request forgery (SSRF)
attacks. The issue has been fixed in both Ambari 2.7.9 and the trunk
branch.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	ambari	< 2.7.9	2.7.9
apache_software_foundation	apache_ambari	< 2.7.9	2.7.9

CWE-611