Vulnerability · Published Mar 9, 2021 · Assigned by apache
CVE-2020-35451Oozie local privilege escalation
Medium 4.7
In plain English
A medium-severity security flaw in Apache Oozie from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS NVD)4.7Medium
Exploit odds (30 days)0.4%top 62.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Oozie | unspecified – before 5.2.1 |
Weakness: CWE-377
References
- https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3E x_refsource_MISC
- [oss-security] 20210309 CVE-2020-35451: Oozie local privilege escalation mailing-list, x_refsource_MLIST