CVE-2023-50380: 
Java vulnerability analysis and mitigation

XML External Entity (XXE) injection vulnerability was discovered in Apache Ambari versions 2.7.0 through 2.7.7. The vulnerability affects the Oozie Workflow Scheduler component and was disclosed in February 2024. The issue allows authenticated users with low privileges to perform file reading operations at the root level and potentially escalate privileges (NVD, OSS Security).

The vulnerability (CVE-2023-50380) stems from improper validation of user input in the Oozie Workflow Scheduler component, specifically related to XML External Entity processing. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and requiring low privileges (NVD).

The vulnerability allows attackers to read arbitrary files on the server, including sensitive system files, through XXE injection. This access could potentially lead to privilege escalation and exposure of confidential system information (NVD, OSS Security).

Users are recommended to upgrade to Apache Ambari version 2.7.8, which contains the fix for this vulnerability (NVD, OSS Security).