{"id":"CVE-2020-35451","aliases":["EUVD-2020-23125","GHSA-9rqf-w99j-7c4r"],"status":"published","title":"Oozie local privilege escalation","description":"There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00434,"percentile":0.37893,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362","CWE-377"],"published":"2021-03-09T15:20:13Z","modified":"2026-10-24T10:30:48Z","products":[{"vendor":"apache","product":"oozie"},{"vendor":"apache software foundation","product":"apache oozie"}],"references":[{"url":"https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5%40%3Cuser.oozie.apache.org%3E","tags":["x_refsource_MISC","mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/09/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35451"},{"url":"https://lists.apache.org/thread.html/r8688debdb8b586aab3e53dee2d675fc9212de0ec627a8d3cd43b5ab5@%3Cuser.oozie.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-9rqf-w99j-7c4r"}],"sources":{"cve":[{"id":"CVE-2020-35451","title":"Oozie local privilege escalation","description":"There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.","status":"published","published":"2021-03-09T15:20:13Z","modified":"2025-02-13T16:27:42.773Z","cwes":["CWE-377"],"updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-23125","description":"There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.","status":"published","published":"2021-03-09T15:20:13Z","modified":"2025-02-13T16:27:42Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-9rqf-w99j-7c4r","title":"There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a...","description":"There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.","status":"published","published":"2022-05-24T17:43:51Z","modified":"2023-01-29T05:06:45Z","cwes":["CWE-362"],"updated_at":"2026-11-02T14:46:05.419939Z"}],"nvd":[{"id":"CVE-2020-35451","description":"There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.","status":"published","published":"2021-03-09T16:15:13.787Z","modified":"2026-06-17T03:13:43.737Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-377","CWE-362"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"CVE-2020-35451","description":"There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.","status":"published","published":"2021-03-09T16:15:13.787Z","modified":"2026-10-24T10:30:48.046913696Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"}]}}