CVE-2017-15712 (GCVE-0-2017-15712)
Vulnerability from cvelistv5
Published
2018-02-19 14:00
Modified
2024-09-17 01:46
Severity ?
CWE
  • Information Disclosure
Summary
Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
References
security@apache.orghttp://www.securityfocus.com/bid/103102Third Party Advisory, VDB Entry
security@apache.orghttps://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/103102Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E
Impacted products
Vendor Product Version
Apache Software Foundation Apache Oozie Version: 3.1.3-incubating to 4.3.0
Version: 5.0.0-beta1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:04:49.266Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "103102",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103102"
          },
          {
            "name": "[dev] 20180215 [CVE-2017-15712] Apache Oozie Server vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Oozie",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "3.1.3-incubating to 4.3.0"
            },
            {
              "status": "affected",
              "version": "5.0.0-beta1"
            }
          ]
        }
      ],
      "datePublic": "2018-02-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-22T10:57:01",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "103102",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103102"
        },
        {
          "name": "[dev] 20180215 [CVE-2017-15712] Apache Oozie Server vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2018-02-15T00:00:00",
          "ID": "CVE-2017-15712",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Oozie",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.1.3-incubating to 4.3.0"
                          },
                          {
                            "version_value": "5.0.0-beta1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "103102",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103102"
            },
            {
              "name": "[dev] 20180215 [CVE-2017-15712] Apache Oozie Server vulnerability",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216@%3Cdev.oozie.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2017-15712",
    "datePublished": "2018-02-19T14:00:00Z",
    "dateReserved": "2017-10-21T00:00:00",
    "dateUpdated": "2024-09-17T01:46:21.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-15712\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2018-02-19T14:29:00.207\",\"lastModified\":\"2024-11-21T03:15:03.943\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad permite que un usuario de Apache Oozie desde la versi\u00f3n 3.1.3-incubating hasta la 4.3.0 y 5.0.0-beta1 exponga archivos privados en el proceso del servidor Oozie. Este usuario malicioso puede construir un archivo XML de flujo de trabajo que contenga directivas XML y configuraci\u00f3n que haga referencia a archivos sensibles en el host del servidor del Oozie.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:N/A:N\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8E27E277-5C05-4A7F-8F3A-705A69CC64C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"553025E8-0C63-4884-AF2B-DE273495FEE6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FDD671D-4BB7-4E34-9FA3-9CBC5D8C72E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61DE1BFA-1092-451C-8298-2B18E504C0F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.2.0:incubating:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E3F39F1-D6A4-4A3D-A599-BDA44C35F325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FB5A75F-E3D6-4473-ACC9-A395784E9257\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.3.0:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"54AA2C05-D12A-40B2-9057-678DE35A26D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.3.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7EF67B4-BAFB-487D-972C-258213C6A400\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D645772-64AA-4D4D-9206-A858592E053D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.3.1:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"34085D87-5EE4-478D-8A6B-97E05F965AFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.3.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"5682A48E-976D-4F0D-BA4C-63B42788500F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B0D2683-519E-4833-9A68-0EA11DF93829\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:3.3.2:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AA8E7A5-530A-4EEE-8613-ECD01CCFA0B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6A0A49A-A1B4-4FEB-94E3-762E40A816E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.0.0:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"92AFFD7F-3B8F-4A06-9EF9-C1BFC6D97519\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"160E96D4-289C-4021-B1D7-2EA9001150A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.0.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DEC1364-33EE-41EB-8692-9039BA7D7969\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A24D04C-CE3C-49FF-B340-D204CFF458E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.0.1:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EC90787-032C-48CC-BCAF-F1D0123B73B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.0.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"963D7266-7665-4849-867F-4DDEC8166813\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE25673C-5D56-42CF-8611-E6189B6A7FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.1.0:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"6343A815-8D76-458C-BB3E-2B095543DA2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.1.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E2BC58D-1695-453B-809C-EAC92D2BDD24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"30F5CE52-B0A6-433E-B8C0-346A9E16FC7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.2.0:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF297DCD-64F6-4035-9998-010CEE6E59F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD866B64-C655-4FEA-B1DA-012A0AE5397F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.3.0:rc0:*:*:*:*:*:*\",\"matchCriteriaId\":\"39A5D900-5625-4653-BC46-B42E2BF97D86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:4.3.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C14F101-7DBA-4872-A055-45B0D6DE2F1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:oozie:5.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C5FADBD-3A42-4BA4-A48E-3AB3AF941C48\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/103102\",\"source\":\"security@apache.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.securityfocus.com/bid/103102\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://lists.apache.org/thread.html/4606709264fe7cb0285e2a12aca2d01a06b14cd58791c9fc32abd216%40%3Cdev.oozie.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.