GitHub Advisoryadvisory · Maven

GHSA-4rjf-mxfm-98h5 SQL injection vulnerability in the policy admin tool in Apache Ranger

HIGH Published 2018-10-17 Modified 2022-04-27 Official page ↗
Aliases
CVE-2016-2174
Ecosystem
Maven
Packages
org.apache.ranger:ranger
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• Maven org.apache.ranger:ranger: < 0.5.3 → fixed in 0.5.3

Description

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.

Related

Alias · CVE (1)

  • CVE-2016-2174 SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References