CVE-2016-2174: SQL Injection Vulnerability in Apache Ranger
Summary
CVE-2016-2174: SQL injection vulnerability in the policy admin tool in Apache Ranger. Affects org.apache.ranger:ranger versions < 0.5.3. Fixed in 0.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is an open-source project that provides a centralized security framework for managing fine-grained access control across various components in the Apache Hadoop ecosystem. It includes a policy admin tool that allows administrators to define and manage access policies for different resources. This vulnerability affects Apache Ranger versions prior to 0.5.3.
Vulnerability Detail
The SQL injection vulnerability in the policy admin tool of Apache Ranger allows remote authenticated administrators to execute arbitrary SQL commands. This vulnerability can be exploited by manipulating the 'eventTime' parameter in the 'service/plugins/policies/eventTime' endpoint. An attacker with administrative privileges can inject malicious SQL code, potentially leading to unauthorized access, data manipulation, or even remote code execution.
How To Fix
Minimum fixed version
0.5.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to a fixed version as soon as possible.
Conclusion
The SQL injection vulnerability in Apache Ranger can be exploited by remote authenticated administrators to execute arbitrary SQL commands. To mitigate this vulnerability, it is recommended to upgrade Apache Ranger to version 0.5.3 or later. There is no known workaround, so it is crucial to apply the official patch or upgrade to a fixed version as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
Apache Ranger is an open-source security framework for managing fine-grained access control in the Apache Hadoop ecosystem.
This vulnerability allows remote authenticated administrators to execute arbitrary SQL commands, potentially leading to unauthorized access, data manipulation, or remote code execution.
To fix this vulnerability, upgrade Apache Ranger to version 0.5.3 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to a fixed version.
You can find more information about this vulnerability in the Apache Ranger advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
