Description

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.

Remediation

References

http://www.securityfocus.com/bid/106266

https://lists.apache.org/thread.html/347e7a8cb86014b7ca37e49eb00b8d088203bdc0bcfb4799f8e5955a%40%3Cuser.oozie.apache.org%3E

Related Vulnerabilities

CVE-2022-21721 Vulnerability in npm package next

CVE-2021-35517 Vulnerability in maven package org.apache.commons:commons-compress

CVE-2019-16777 Vulnerability in maven package org.webjars.npm:npm

CVE-2021-22204 Vulnerability in npm package exiftool-vendored

CVE-2019-13506 Vulnerability in npm package devalue

Severity

High

Classification

CWE-20 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Third Party Advisory VDB Entry