PT-2016-4393 · Apache · Apache Ranger

Publicado 2016-04-11 · Atualizado 2022-05-17 · CVE-2016-0735

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ranger versions 0.5.x before 0.5.2

Description The issue allows remote authenticated users to bypass intended parent resource-level access restrictions. This is due to the mishandling of a resource-level exclude policy.

Recommendations For Apache Ranger versions 0.5.x before 0.5.2, update to version 0.5.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-0735

GHSA-22V7-W6C5-V4RR

Produtos afetados

Apache Ranger

Referências · 6

• https://github.com/apache/ranger · Nota
• https://github.com/apache/ranger/commit/18f216d0201eab93daea0b57035f7e6e3280bcfd · Nota
• https://osv.dev/vulnerability/CVE-2016-0735 · Aviso do Fabricante
• http://mail-archives.apache.org/mod_mbox/ranger-dev/201603.mbox/%3CD31EE434.14B879%25vel%40apache.org%3E · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0735 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-22v7-w6c5-v4rr · Aviso do Fabricante