PT-2016-6407 · Apache · Apache Ranger

Victor Hora · Published 2016-09-26 · Updated 2018-10-17 · CVE-2016-5395

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.6.1

Description A cross-site scripting (XSS) issue exists in the create user functionality of the policy admin tool. This allows remote authenticated administrators to inject arbitrary web script or HTML. The issue is related to policies.

Recommendations For versions prior to 0.6.1, update to version 0.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the create user functionality in the policy admin tool until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-5395

GHSA-RF7Q-XQM3-6923

Affected Products

Apache Ranger

References · 6

• https://osv.dev/vulnerability/CVE-2016-5395 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rf7q-xqm3-6923 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5395 · Security Note
• https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger · Vendor Advisory
• https://github.com/advisories/GHSA-rf7q-xqm3-6923 · Note
• http://securityfocus.com/bid/92577 · Note