GHSA-g9gf-g5jq-9h3v
Apache Ranger UI vulnerable to Server Side Request Forgery
At a glance
- Published
- Updated
- CVE
- CVE-2024-45479
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.ranger:ranger | introduced 0.5.0, fixed 2.5.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-45479 ADVISORY
- https://github.com/apache/ranger/commit/447658578decf33d2b68d872a32db59227dfef1b#diff-0cb27d5067c1eced82c6a8a755e6142d20c633820996701a1ca616345ea8b1ca WEB
- https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger WEB
- https://github.com/apache/ranger PACKAGE
- http://www.openwall.com/lists/oss-security/2025/01/21/4 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |