CVE-2016-8751 Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies
MediumCVSS 4.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.ranger/ranger(Maven) | < 0.6.3 | 0.6.3 |
| org.apache.ranger/ranger(Maven) | = 0.6.0 | No fix listed |
| org.apache.ranger/ranger(Maven) | = 0.6.1 | No fix listed |
| org.apache.ranger/ranger(Maven) | = 0.6.2 | No fix listed |
| apache ranger | < 0.6.3 | 0.6.3 |
| Apache Ranger | = 0.5.x | No fix listed |
| Apache Ranger | = 0.6.0 - 0.6.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- cwiki.apache.org release-notes vendor-advisory
- github.com vendor-advisory
- 99067 third-party-advisory vdb-entry