Skip to content
OpenAdvisories
High MSRC-CVE-2023-36419 1 CVE

Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability

Published Oct 10, 2023 · Updated Nov 30, 2023 · Revision 2

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain cluster administrator privileges.

What action is required to secure my resources against this vulnerability?
A script action has been made available to assist customers with updating their resources as required which can be found here: CVE-2023-36419 Script Action

Security updates
2308221128 — https://learn.microsoft.com/en-us/azure/hdinsight/hdinsight-release-notes

Vulnerabilities 1

  • High 8.8
    CVE-2023-36419

    Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability

    Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability

    Microsoft Azure HDInsight

Revision history

  1. #2

    Updated CVE title. This is an informational change only.

  2. #1

    Information published.

References