CVE-2025-23195

Katalog CVE

CVSS 7.5 · High EPSS 0,75%

Kerentanan Improper Restriction of XML External Entity Reference pada apache ambari. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` class without disabling external entity resolution. An attacker can exploit this vulnerability to read arbitrary files on the server or perform server-side request forgery (SSRF) attacks. The issue has been fixed in both Ambari 2.7.9 and the trunk branch.

Rincian

Terbit di NVD

21 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/hsb6mvxd7g37dq1ygtd0pd88gs9tfcwq advisory vendor
• http://www.openwall.com/lists/oss-security/2025/01/21/7 mailing list · advisory vendor