CVE-2023-50380

XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue. More Details: Oozie Workflow Scheduler had a vulnerability that allowed for root-level file reading and privilege escalation from low-privilege users. The vulnerability was caused through lack of proper user input validation. This vulnerability is known as an XML External Entity (XXE) injection attack. Attackers can exploit XXE vulnerabilities to read arbitrary files on the server, including sensitive system files. In theory, it might be possible to use this to escalate privileges.

• CWE-611

• http://www.openwall.com/lists/oss-security/2024/02/27/6Mailing List
• https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/02/27/6Mailing List
• https://lists.apache.org/thread/qrt7mq7v7zyrh1qsh1gkg1m7clysvy32Vendor Advisory

Published

Feb 27, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50375Missing Authorization vulnerability in edo888 Google Languag…5.3
• CVE-2023-50376Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2023-50377Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-50378Lack of proper input validation and constraint enforcement i…6.1
• CVE-2023-50379Malicious code injection in Apache Ambari in prior to 2.7.8.…8.8
• CVE-2023-5038badmonkey, a Security Researcher has found a flaw that allow…7.5
• CVE-2023-50381Three os command injection vulnerabilities exist in the boa …7.2
• CVE-2023-50382Three os command injection vulnerabilities exist in the boa …7.2
• CVE-2023-50383Three os command injection vulnerabilities exist in the boa …7.2
• CVE-2023-50386Improper Control of Dynamically-Managed Code Resources, Unre…8.8
• CVE-2023-50387Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 403…7.5
• CVE-2023-50395 SQL Injection Remote Code Execution Vulnerability was found…8