CVE-2016-8751: Stored Cross-Site Scripting in Apache Ranger
Summary
CVE-2016-8751: Apache Ranger before 0.6.is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Affects org.apache.ranger:ranger versions < 0.6.3. Fixed in 0.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is an open-source project that provides centralized security administration for Hadoop components. It allows administrators to define and manage fine-grained access policies for various data processing frameworks. The vulnerability in Apache Ranger versions prior to 0.6.3 allows admin users to store arbitrary JavaScript code, which can be executed when normal users login and access policies.
Vulnerability Detail
The vulnerability, known as Stored Cross-Site Scripting (XSS), arises when entering custom policy conditions. Admin users can exploit this vulnerability by storing malicious JavaScript code, which will be executed when normal users access policies. This can lead to unauthorized actions, data theft, or other malicious activities. The vulnerability has a CVSS score of 4.8, indicating a moderate severity level.
How To Fix
Latest published version: 2.9.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the patched version of Apache Ranger.
Conclusion
The Stored Cross-Site Scripting vulnerability in Apache Ranger versions prior to 0.6.3 allows admin users to store arbitrary JavaScript code, which can be executed when normal users access policies. To mitigate this vulnerability, it is crucial to upgrade to Apache Ranger version 0.6.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
Apache Ranger is an open-source project that provides centralized security administration for Hadoop components. It allows administrators to define and manage fine-grained access policies for various data processing frameworks.
Stored Cross-Site Scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious scripts into a website or application. In this case, the vulnerability in Apache Ranger allows admin users to store arbitrary JavaScript code, which can be executed when normal users access policies.
The potential risks of this vulnerability include unauthorized actions, data theft, or other malicious activities. An attacker could exploit the vulnerability to execute arbitrary JavaScript code on the user's browser, potentially compromising sensitive information or performing unauthorized actions.
The severity level of this vulnerability is moderate, with a CVSS score of 4.8. While it is not the highest level of severity, it still poses a significant risk and should be addressed promptly.
To fix this vulnerability, it is recommended to upgrade to Apache Ranger version 0.6.3 or later. This version includes a fix for the Stored XSS vulnerability. Users should update their Apache Ranger installation by following the upgrade instructions provided by the Apache Ranger project.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
