GitHub Advisoryadvisory · Maven

GHSA-rf7q-xqm3-6923 Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML

MEDIUM Published 2018-10-17 Modified 2022-04-27 Official page ↗
Aliases
CVE-2016-5395
Ecosystem
Maven
Packages
org.apache.ranger:ranger
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• Maven org.apache.ranger:ranger: < 0.6.1 → fixed in 0.6.1

Description

Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies.

Related

Alias · CVE (1)

  • CVE-2016-5395 Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References