An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` class without disabling external entity resolution. An attacker can exploit this vulnerability to read arbitrary files on the server or perform server-side request forgery (SSRF) attacks. The issue has been fixed in both Ambari 2.7.9 and the trunk branch.
Conclusion & alert: CVE-2025-23195 is rated Moderate Risk (47.1/100): CVSS High severity, with low exploitation likelihood (EPSS 0.69%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.34% | 0.69% | +0.36% |
| 2 | 2026-06-12 | 0.25% | 0.34% | +0.09% |
| 3 | 2026-06-07 | — | 0.25% | — |
Full EPSS history (11 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/hsb6mvxd7g37dq1ygtd0pd88gs9tfcwq | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2025/01/21/7 | Mailing List Vendor Advisory |