Lucene search

GitHub Advisory DatabaseGHSA-RF7Q-XQM3-6923

HistoryOct 17, 2018 - 5:21 p.m.

Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML

2018-10-1717:21:37

CWE-79

GitHub Advisory Database

github.com

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.006 Low

EPSS

Percentile

77.9%

JSON

Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies.

Affected configurations

Vulners

Node

org.apache.ranger\Matchranger

CPENameOperatorVersion
org.apache.ranger:rangerlt0.6.1

CPE	Name	Operator	Version
	org.apache.ranger:ranger	lt	0.6.1

References

www.securityfocus.com/bid/92577

cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

github.com/advisories/GHSA-rf7q-xqm3-6923

nvd.nist.gov/vuln/detail/CVE-2016-5395

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

0.006 Low

EPSS

Percentile

77.9%

JSON

Related for GHSA-RF7Q-XQM3-6923