XXE attack in Apache Oozie - CVE-2017-15712

Vulnerability identifier: #VU10632

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15712

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform XXE attack.

The weakness exists due to constructing a workflow XML file containing XML directives. A remote attacker can obtain private files on the server process.

Apache Oozie
Cloudera Data Platform Private Cloud Base for IBM

Update to version 4.3.1 or later.

Cloudera Data Platform Private Cloud Base for IBM - update to 7.1.9.3 HF2

• http://mail-archives.us.apache.org/mod_mbox/www-announce/201802.mbox/%3CCABBupGWtC2vN-JzXWeuDaN-_bP6...

• Information disclosure in Apache Oozie
• Multiple vulnerabilities in IBM Cloudera Data Platform Private Cloud Base with IBM (CDP)