CVE-2018-11799

    Dashboard / Vulnerabilities / CVE-2018-11799

    CVE-2018-11799

    Published: 19 Dec 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.

    References: https://lists.apache.org/thread.html/347e7a8cb86014b7ca37e49eb00b8d088203bdc0bcfb4799f8e5955a%40%3Cuser.oozie.apache.org%3E, http://www.securityfocus.com/bid/106266

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4221dcfdb0d084c2e57c8216fc6145349b29aaa5
    Fixed -352b76ebc9f5c3f548275214f1a29078622ab830

    Affected versions

    release-3.1.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-11799 | CVE-DB