CVE-2025-23195: Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie
An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the DocumentBuilderFactory class without disabling external entity resolution. An attacker can exploit this vulnerability to read arbitrary files on the server or perform server-side request forgery (SSRF) attacks. The issue has been fixed in both Ambari 2.7.9 and the trunk branch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-23195?
CVE-2025-23195 is classified as a critical vulnerability due to its potential for remote code execution through XML External Entity attacks.
How do I fix CVE-2025-23195?
To remediate CVE-2025-23195, you should upgrade Apache Ambari to version 2.7.9 or later and ensure that external entity resolution is disabled in XML parsers.
What software is affected by CVE-2025-23195?
CVE-2025-23195 affects Apache Ambari versions earlier than 2.7.9.
What types of attacks can CVE-2025-23195 facilitate?
CVE-2025-23195 can allow attackers to read sensitive files, perform internal port scanning, and execute denial-of-service attacks through malicious XML input.
Is CVE-2025-23195 easy to exploit?
Yes, CVE-2025-23195 is deemed relatively easy to exploit if the vulnerable software is accessible to an attacker.