PT-2025-9504 · Apache · Apache Ranger

김도균 · Published 2025-03-03 · Updated 2025-03-06 · CVE-2024-55532

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.6.0

Description The issue concerns the Export CSV feature in Apache Ranger, where there is an improper neutralization of formula elements. Users are advised to upgrade to a fixed version to address this issue.

Recommendations For versions prior to 2.6.0, upgrade to version 2.6.0 to fix the issue.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2024-55532

GHSA-2H4W-P9FH-9RMV

Affected Products

Apache Ranger

References · 11

• https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55532 · Security Note
• https://osv.dev/vulnerability/GHSA-2h4w-p9fh-9rmv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55532 · Vendor Advisory
• https://github.com/apache/ranger · Note
• https://github.com/apache/ranger/commit/8d89fec991f05bd92e28f459bc2b3a3024aaad82 · Note
• https://twitter.com/CCBalert/status/1897646107334778954 · Twitter Post
• https://cwiki.apache.org/confluence/display/RANGER/Apache+Ranger+2.6.0+-+Release+Notes · Note
• https://issues.apache.org/jira/browse/RANGER-5015 · Note
• https://twitter.com/CVEnew/status/1896767612735914152 · Twitter Post
• http://openwall.com/lists/oss-security/2025/03/03/2 · Note