CVE-2019-12397: Cross-site scripting in Apache Ranger
Summary
CVE-2019-12397: Cross-site scripting in Apache Ranger. Affects org.apache.ranger:ranger versions >= 0.7.0, < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ranger is an open-source security framework that provides centralized security administration for Hadoop ecosystem components. It enables fine-grained access control and centralized auditing across various data platforms. The vulnerability in Apache Ranger versions 0.7.0 to 1.2.0 allows for a cross-site scripting (XSS) attack through the policy import functionality.
Vulnerability Detail
The policy import functionality in Apache Ranger is susceptible to a cross-site scripting (XSS) issue. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. By exploiting this vulnerability, an attacker can potentially steal sensitive information, perform actions on behalf of the user, or manipulate the displayed content. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, Apache Ranger versions 0.7.0 to 1.2.0 are vulnerable to a cross-site scripting (XSS) issue in the policy import functionality. Upgrading to version 2.0.0 or a later release is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
Apache Ranger is an open-source security framework that provides centralized security administration for Hadoop ecosystem components. It enables fine-grained access control and centralized auditing across various data platforms.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or manipulating displayed content.
This vulnerability in Apache Ranger can allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to unauthorized access, data theft, or manipulation of the application's content.
To fix this vulnerability, it is recommended to upgrade to version 2.0.0 or a later release of Apache Ranger that includes the fix. This ensures that the policy import functionality is secure and protected against cross-site scripting attacks.
No specific workaround has been provided for this vulnerability. It is advised to upgrade to the fixed version of Apache Ranger.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
