CVE-2022-45048

Affected product: Apache Ranger (v2.3.0). Issue: code execution vulnerability via injectable policy expressions in created policies. Root cause (as stated): authenticated users with appropriate privileges can craft expressions that trigger execution. Impact: CVSS high, enabling total compromise p...

CVE-2022-45048 Apache Ranger: code execution vulnerability in policy expressions

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0...

Apache Ranger 安全漏洞

Apache Ranger is a set of architectures from the U.S.-based Apache Foundation that implements comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

Apache Ranger 注入漏洞

Apache Ranger is a set of architectures from the U.S.-based Apache Foundation that implements comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

PT-2023-14577 · Apache · Apache Ranger

Name of the Vulnerable Software and Affected Versions: Apache Ranger version 2.3.0 Description: The issue allows authenticated users with appropriate privileges to create policies having expressions that can exploit a code execution vulnerability. Recommendations: For Apache Ranger version 2.3.0,...

K43254923: Apache Ranger vulnerability CVE-2016-2174

Security Advisory Description SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime. CVE-2016-2174 Impact There is no impact;...

Apache Ranger Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header...

GHSA-83M2-9G78-RRJ4 Apache Ranger Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header...

GHSA-7CCV-HHVC-62HG Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs...

Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs...

GHSA-QQG7-GCXW-GMJ3 Apache Ranger allows users to bypass intended access restrictions via the REST API

The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API...

Apache Ranger allows users to bypass intended access restrictions via the REST API

The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API...

Apache Ranger Access Restriction Bypass

Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy...

GHSA-22V7-W6C5-V4RR Apache Ranger Access Restriction Bypass

Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

Authorization

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131 Impala logs contain secrets

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...