CVE-2016-8746

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...

CVE-2016-8746

CVE-2016-8746 affects Apache Ranger policy engine prior to version 0.6.3. The issue is a path-matching defect that occurs under recursive evaluation when policies do not contain wildcards, enablingmis-matches and potential security bypass. The vulnerability is scoped to the policy engine logic (n...

CVE-2017-7677

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table...

CVE-2017-7677

CVE-2017-7677 affects the Hive Authorizer in Apache Ranger prior to 0.7.1. In environments using external locations for Hive tables, it should check RWX permissions for create table, but this check is missing, enabling a potential permission-check bypass when creating tables. The issue is address...

CVE-2016-8751

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies...

CVE-2016-8746

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...

CVE-2016-8751

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies...

PT-2017-17877

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.7.1 Description The issue concerns the Hive Authorizer in Apache Ranger, which fails to properly check RWX permission for creating tables in environments that use an external location for hive tables...

PT-2017-9777

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.6.3 Description The policy engine in Apache Ranger incorrectly matches paths under certain conditions. This issue occurs when the policy does not contain wildcards and the recursion flag is set to true...

CVE-2017-7677: Missing Authorization

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table...

PT-2017-9781

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.6.3 Description The issue allows admin users to store arbitrary javascript code, which is executed when normal users login and access policies, due to a Stored Cross-Site Scripting vulnerability when entering...

CVE-2016-8746: Untrusted Search Path

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...

PT-2017-2755

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 0.7.1 Description The policy resource matcher in Apache Ranger ignores characters after the '' wildcard character, which can result in unintended behavior. This issue can be exploited by a remote attacker to cau...

CVE-2017-7676: Improper Input Validation

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character - like mytest, test.txt. This can result in unintended behavior...

CVE-2016-8751: Improper Neutralization of Input During Web Page Generation

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies...

Apache Ranger 0.5.x / 0.6.x / 0.7.0 Policy Miss / Permission Check Vulnerability

Apache Ranger versions prior to 0.7.1 suffer from issues where policy evaluation ignores characters after the asterisk wildcard character and the Hive Authorizer fails to check for RWX permission when an external location is specified. Hello: Please find below details on CVEs fixed in Ranger 0.7....

Permission Checking Bypass

ranger is vulnerable to permission checking bypass. The vulnerability exists because RangerHiveAuthorizer.java fails to check for RWX permissions when an external location is used to create hive tables...

Unintended Behaviours

ranger-plugins-common is vulnerable to unintended behaviors. It is possible because the policy resource matcher does not properly handle the policies with characters after a wildcard character, leading to unintended behaviors...

Apache Ranger =< 0.5.2 allows to download policy definitions without authentication

Apache Ranger =:6080/service/plugins/policies/download/ The prerequisite to exploit this flaw is to know or guess the policy name. This finding may not constitute a vulnerability by itself, but is equivalent to having access to a network filtering policy: finding holes in policies is then easier...

Apache Ranger eventTime parameter SQL injection Vulnerability (CVE-2016-2174)

Description ----------- Apache Ranger =:6080/service/plugins/policies/eventTime ?eventTime=' or '1'='1 &policyId=1 The vulnerable code is located in the org/apache/ranger/db/XXDataHistDao.java file in the findObjByEventTimeClassTypeAndId function: public XXDataHist...