What’s Vulnerable › Vulnerabilities

CVE-2023-50380: Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-27 · updated 2026-06-17
• Weakness: CWE-611

Description

XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation. This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.

Affected products

• Apache Software Foundation Apache Ambari: from 2.7.0 before 2.7.8 — fixed in 2.7.8

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Ambari 2.7.8. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/02/27/6
• https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32
• http://www.openwall.com/lists/oss-security/2024/02/27/6
• https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32

Get alerted when CVE-2023-50380 or the next vulnerability affects your stack