TI-2020-17980 Aliases CVE-2020-35451 GHSA-9rqf-w99j-7c4r

Oozie local privilege escalation

LOW 22CWE-377Published 2021-03-09 · Updated 2025-02-13

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.

Why it matters now

EPSS 0.00434 37th percentileScored 2026-11-07

Fix Fixed Apache Oozie (Apache Software Foundation): 5.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Oozie	before 5.2.1	5.2.1	Patch available	CNA

Apache Oozie VendorApache Affected before 5.2.1 Fixed in 5.2.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:oozie::::::::	before 5.2.1	Vulnerable	Apache

cpe:2.3:a:apache:oozie:*:*:*:*:*:*:*:* Versions before 5.2.1 Vulnerable ·Apache

Remediation

Fix · CNA Apache Oozie (Apache Software Foundation) Fixed in 5.2.1

Timeline

2026-10-02 Threatist record created from CVE-2020-35451
2026-10-03 Alias added: GHSA-9rqf-w99j-7c4r

References

Advisory 2

TI-2017-11484 Path traversal in Apache Oozie CVSS 3.0MEDIUM 6.5
TI-2018-08453 Improper input validation in Apache Oozie CVSS 3.0MEDIUM 6.5
TI-2025-19709 Apache Oozie: XSS in Oozie Web Console CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences