GitHub Advisoryadvisory · Maven

GHSA-89gw-cffj-mqg9 Apache Ranger code execution vulnerability in policy expressions

HIGH Published 2023-07-06 Modified 2023-07-06 Official page ↗
Aliases
CVE-2022-45048
Ecosystem
Maven
Packages
org.apache.ranger:ranger
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2023-07-06

Affected packages

• Maven org.apache.ranger:ranger: >= 2.3.0, < 2.4.0 → fixed in 2.4.0

Description

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.

Related

Alias · CVE (1)

  • CVE-2022-45048 Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References