Lucene search

ApacheCVE-2016-6815

HistoryOct 13, 2017 - 2:29 p.m.

CVE-2016-6815

2017-10-1314:29:00

CWE-255

apache

web.nvd.nist.gov

cve-2016-6815

apache ranger

privilege escalation

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

36.6%

JSON

In Apache Ranger before 0.6.2, users with “keyadmin” role should not be allowed to change password for users with “admin” role.

Affected configurations

Nvd

Vulners

Node

apacherangerMatch0.4.0

apacherangerMatch0.5.0

apacherangerMatch0.5.1

apacherangerMatch0.5.2

apacherangerMatch0.5.3

apacherangerMatch0.6.0

apacherangerMatch0.6.1

VendorProductVersionCPE
apacheranger0.4.0cpe:2.3:a:apache:ranger:0.4.0:*:*:*:*:*:*:*
apacheranger0.5.0cpe:2.3:a:apache:ranger:0.5.0:*:*:*:*:*:*:*
apacheranger0.5.1cpe:2.3:a:apache:ranger:0.5.1:*:*:*:*:*:*:*
apacheranger0.5.2cpe:2.3:a:apache:ranger:0.5.2:*:*:*:*:*:*:*
apacheranger0.5.3cpe:2.3:a:apache:ranger:0.5.3:*:*:*:*:*:*:*
apacheranger0.6.0cpe:2.3:a:apache:ranger:0.6.0:*:*:*:*:*:*:*
apacheranger0.6.1cpe:2.3:a:apache:ranger:0.6.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	ranger	0.4.0	cpe:2.3:a:apache:ranger:0.4.0:::::::*
apache	ranger	0.5.0	cpe:2.3:a:apache:ranger:0.5.0:::::::*
apache	ranger	0.5.1	cpe:2.3:a:apache:ranger:0.5.1:::::::*
apache	ranger	0.5.2	cpe:2.3:a:apache:ranger:0.5.2:::::::*
apache	ranger	0.5.3	cpe:2.3:a:apache:ranger:0.5.3:::::::*
apache	ranger	0.6.0	cpe:2.3:a:apache:ranger:0.6.0:::::::*
apache	ranger	0.6.1	cpe:2.3:a:apache:ranger:0.6.1:::::::*

CNA Affected

[
  {
    "product": "Apache Ranger",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "0.5.x"
      },
      {
        "status": "affected",
        "version": "0.6.0"
      },
      {
        "status": "affected",
        "version": "0.6.1"
      }
    ]
  }
]

References

www.securityfocus.com/bid/94221

cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

36.6%

JSON

Related for CVE-2016-6815