CVE-2023-50380 Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server

What is CVE-2023-50380?

CVE-2023-50380 is a medium-severity vulnerability in Apache Ambari, published on 27 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue.

More Details:

Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation.

This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.

Weakness: CWE-611

Which versions are affected by CVE-2023-50380?

2 open source packages ship an affected version, including org.apache.ambari.contrib.views:wfmanager. It affects 1 product.

Products include Apache Ambari.

How do I fix CVE-2023-50380?

Upgrade org.apache.ambari.contrib.views:wfmanager to 2.7.8 or later.

Is CVE-2023-50380 being exploited?

There is no known exploitation of CVE-2023-50380 in the wild and no public exploit code.

Other vulnerabilities in Apache Ambari

• CVE-2017-5642 Misconfiguration in Apache Ambari Critical 9.8
• CVE-2014-3582 Command injection in n/a Critical 9.8
• CVE-2016-6807 Apache Ambari Improper Access Control Critical 9.8
• CVE-2024-51941 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts High 8.8
• CVE-2025-23196 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qrp9-23p7-g5mf.