GHSA-v7mf-qgxf-qmvf

Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies

En bref

Publiée: 2018-10-17 17:21 UTC
Mise à jour: 2023-11-08 03:58 UTC
CVE: CVE-2016-8751
CVSS_V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Description

Apache Ranger before 0.6.is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Paquets affectés

Paquet	Versions
Maven · org.apache.ranger:ranger	introduced 0, fixed 0.6.3

Références

https://nvd.nist.gov/vuln/detail/CVE-2016-8751 ADVISORY
https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger WEB
https://github.com/advisories/GHSA-v7mf-qgxf-qmvf ADVISORY
http://www.securityfocus.com/bid/99067 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database