PT-2016-4393 · Apache · Apache Ranger

Published 2016-04-11 · Updated 2022-05-17 · CVE-2016-0735

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ranger versions 0.5.x before 0.5.2

Description The issue allows remote authenticated users to bypass intended parent resource-level access restrictions. This is due to the mishandling of a resource-level exclude policy.

Recommendations For Apache Ranger versions 0.5.x before 0.5.2, update to version 0.5.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-0735

GHSA-22V7-W6C5-V4RR

Affected Products

Apache Ranger

References · 6

• https://osv.dev/vulnerability/CVE-2016-0735 · Vendor Advisory
• http://mail-archives.apache.org/mod_mbox/ranger-dev/201603.mbox/%3CD31EE434.14B879%25vel%40apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0735 · Security Note
• https://osv.dev/vulnerability/GHSA-22v7-w6c5-v4rr · Vendor Advisory
• https://github.com/apache/ranger · Note
• https://github.com/apache/ranger/commit/18f216d0201eab93daea0b57035f7e6e3280bcfd · Note