XML External Entity (XXE) Injection

Apache Phoenix is vulnerable to XML external entities XXE Injection attacks. The application does not disable DTD parsing by default, allowing a malicious user to inject external XML entities...

Arbitrary Code Execution

Apache Phoenix-hive is vulnerable to arbitrary code execution attacks. The attacks can be triggered because it directly uses ObjectInputStream which deserializes the classes without validation and leads to code execution...