Read the docs
TI-2023-27566 Aliases CVE-2023-50380GHSA-qrp9-23p7-g5mf

Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server

Priority LOW 30CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation. This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00865 58th percentileScored 2026-11-07
Fix Fixed org.apache.ambari.contrib.views:wfmanager (Maven): 2.7.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Ambari2.7.0 – 2.7.7—No fix listedCNA
—org.apache.ambari.contrib.views:wfmanager (Maven)2.7.0 to before 2.7.82.7.8Patch availableGHSA-qrp9-23p7-g5mf
  • Apache Ambari VendorApache Affected 2.7.0 – 2.7.7 Fixed in — No fix listed CNA
  • org.apache.ambari.contrib.views:wfmanager (Maven) Vendor— Affected 2.7.0 to before 2.7.8 Fixed in 2.7.8 Patch available GHSA-qrp9-23p7-g5mf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:ambari:*:*:*:*:*:*:*:*2.7.0 to before 2.7.8VulnerableApache
  • cpe:2.3:a:apache:ambari:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.8 Vulnerable ·Apache

Remediation

  • Fix · GHSA-qrp9-23p7-g5mf org.apache.ambari.contrib.views:wfmanager (Maven) Fixed in 2.7.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50380
  2. 2026-10-03 Alias added: GHSA-qrp9-23p7-g5mf

References

Advisory 2

Other 3

  • TI-2016-05848 Improper access control in Apache Ambari CVSS 3.0CRITICAL 9.8
  • TI-2017-03642 During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. CVSS 3.0CRITICAL 9.8
  • TI-2014-02906 In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on… CVSS 3.0CRITICAL 9.8
  • TI-2025-16981 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition CVSS 3.1HIGH 8.8
  • TI-2024-34845 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts CVSS 3.1HIGH 8.8
  • TI-2023-27565 Apache Ambari: authenticated users could perform command injection to perform RCE CVSS 3.1HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences