CVE-2016-5395: Apache Ranger - Cross-Site Scripting (XSS) Vulnerability
Summary
CVE-2016-5395: Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML. Affects org.apache.ranger:ranger versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is an open-source security framework that provides centralized security administration for Hadoop components. It allows administrators to define and manage fine-grained policies for controlling access to various resources within the Hadoop ecosystem. The package affected by this vulnerability is 'org.apache.ranger:ranger'.
Vulnerability Detail
The vulnerability identified as CVE-2016-5395 is a Cross-Site Scripting (XSS) vulnerability in the create user functionality of the policy admin tool in Apache Ranger. Remote authenticated administrators can exploit this vulnerability to inject arbitrary web script or HTML through vectors related to policies. This can lead to the execution of malicious code within the context of the affected user's browser, potentially compromising the confidentiality and integrity of user data.
How To Fix
Minimum fixed version
0.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The Cross-Site Scripting (XSS) vulnerability in Apache Ranger's policy admin tool can be exploited by remote authenticated administrators to inject arbitrary web script or HTML. Upgrading to Apache Ranger version 0.6.1 or later is recommended to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
Apache Ranger is an open-source security framework for managing fine-grained access control policies across the Hadoop ecosystem.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows remote authenticated administrators to inject arbitrary web script or HTML, potentially compromising the security and integrity of Apache Ranger.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
