Moderate severity vulnerability that affects org.apache.oozie:oozie-core

2018-12-2022:01:18

Google

osv.dev

0.001 Low

EPSS

Percentile

26.3%

JSON

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user’s name.

CPENameOperatorVersion
org.apache.oozie:oozie-coreeq4.3.0
org.apache.oozie:oozie-coreeq4.1.0
org.apache.oozie:oozie-coreeq5.0.0-beta1
org.apache.oozie:oozie-coreeq4.3.1
org.apache.oozie:oozie-coreeq5.0.0
org.apache.oozie:oozie-coreeq4.2.0

Name	Operator	Version
org.apache.oozie:oozie-core	eq	4.3.0
org.apache.oozie:oozie-core	eq	4.1.0
org.apache.oozie:oozie-core	eq	5.0.0-beta1
org.apache.oozie:oozie-core	eq	4.3.1
org.apache.oozie:oozie-core	eq	5.0.0
org.apache.oozie:oozie-core	eq	4.2.0