Design/Logic Flaw

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from...

Remote code execution

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0...

CVE-2021-40331 Permissions problem in the Apache Ranger Hive Plugin

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from...

CVE-2021-40331 Permissions problem in the Apache Ranger Hive Plugin

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from...

CVE-2021-40331

The CVE-2021-40331 entry describes an Incorrect Permission Assignment for Critical Resource in Apache Ranger Hive Plugin. Affected versions are 2.0.0 through 2.3.0; any user with SELECT privilege on a database can alter Hive table ownership when the plugin is enabled. Root cause is improper privi...

CVE-2022-45048 Apache Ranger: code execution vulnerability in policy expressions

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0...

CVE-2022-45048 Apache Ranger: code execution vulnerability in policy expressions

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0...

CVE-2022-45048

Affected product: Apache Ranger (v2.3.0). Issue: code execution vulnerability via injectable policy expressions in created policies. Root cause (as stated): authenticated users with appropriate privileges can craft expressions that trigger execution. Impact: CVSS high, enabling total compromise p...

CVE-2022-45048 Apache Ranger: code execution vulnerability in policy expressions

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0...

Apache Ranger 安全漏洞

Apache Ranger is a set of architectures from the U.S.-based Apache Foundation that implements comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

Apache Ranger 注入漏洞

Apache Ranger is a set of architectures from the U.S.-based Apache Foundation that implements comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

PT-2023-14577 · Apache · Apache Ranger

Name of the Vulnerable Software and Affected Versions: Apache Ranger version 2.3.0 Description: The issue allows authenticated users with appropriate privileges to create policies having expressions that can exploit a code execution vulnerability. Recommendations: For Apache Ranger version 2.3.0,...

K43254923: Apache Ranger vulnerability CVE-2016-2174

Security Advisory Description SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime. CVE-2016-2174 Impact There is no impact;...

GHSA-83M2-9G78-RRJ4 Apache Ranger Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header...

Apache Ranger Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header...

GHSA-7CCV-HHVC-62HG Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs...

Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs...

GHSA-QQG7-GCXW-GMJ3 Apache Ranger allows users to bypass intended access restrictions via the REST API

The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API...

Apache Ranger allows users to bypass intended access restrictions via the REST API

The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API...

Apache Ranger Access Restriction Bypass

Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy...