CVE-2025-23195 Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie
An attacker can exploit insecure XML parsing in Apache Ambari to read arbitrary files or perform SSRF attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-23195?
CVE-2025-23195 is a high-severity vulnerability in Apache Ambari, published on 21 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` class without disabling external entity resolution. An attacker can exploit this vulnerability to read arbitrary files on the server or perform server-side request forgery (SSRF) attacks. The issue has been fixed in both Ambari 2.7.9 and the trunk branch.
Weakness: CWE-611
Which versions are affected by CVE-2025-23195?
It affects 1 product.
Products include Apache Ambari.
How do I fix CVE-2025-23195?
No fix has been published for CVE-2025-23195 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-23195 being exploited?
There is no known exploitation of CVE-2025-23195 in the wild and no public exploit code.
Other vulnerabilities in Apache Ambari
- CVE-2017-5642 Misconfiguration in Apache Ambari
- CVE-2014-3582 Command injection in n/a
- CVE-2016-6807 Apache Ambari Improper Access Control
- CVE-2024-51941 Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts
- CVE-2025-23196 Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition
Sources
Also known as GHSA-jjxh-vpf5-jm42.