org.apache.ranger:ranger (Maven)
Advisories
17
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.5.0 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.ranger</groupId><artifactId>ranger</artifactId><version>2.5.0</version></dependency>gradle
implementation("org.apache.ranger:ranger:2.5.0")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6qc3-v8fv-fv9j Apache Ranger has a Command Injection vulnerability |
Critical EPSS 2.63% |
>= 0.6.0, <= 2.8.0 | No fix yet |
| GHSA-g9gf-g5jq-9h3v Apache Ranger UI vulnerable to Server Side Request Forgery |
Critical EPSS 0.69% |
>= 0.5.0, < 2.5.0 | 2.5.0 |
| GHSA-vrx2-mgr9-v67h Apache Ranger has Stored Cross-site Scripting vulnerability in Edit Service Page |
Medium EPSS 0.61% |
< 2.5.0 | 2.5.0 |
| GHSA-89gw-cffj-mqg9 Apache Ranger code execution vulnerability in policy expressions |
High EPSS 1.13% |
>= 2.3.0, < 2.4.0 | 2.4.0 |
| GHSA-83m2-9g78-rrj4 Apache Ranger Cross-site Scripting vulnerability |
Medium EPSS 4.85% |
< 0.5.0 | 0.5.0 |
| GHSA-7ccv-hhvc-62hg Apache Ranger allows users to bypass intended access restrictions via direct access to module URLs |
High EPSS 2.10% |
< 0.5.0 | 0.5.0 |
| GHSA-qqg7-gcxw-gmj3 Apache Ranger allows users to bypass intended access restrictions via the REST API |
Medium EPSS 1.93% |
< 0.5.1 | 0.5.1 |
| GHSA-22v7-w6c5-v4rr Apache Ranger Access Restriction Bypass |
High EPSS 1.67% |
>= 0.5.0, < 0.5.2 | 0.5.2 |
| GHSA-fpqp-v323-44xv Cross-site scripting in Apache Ranger |
Medium EPSS 2.96% |
>= 0.7.0, < 2.0.0 | 2.0.0 |
| GHSA-ffjh-fjgg-mfpq Moderate severity vulnerability that affects org.apache.ranger:ranger |
Medium EPSS 2.61% |
< 0.7.1 | 0.7.1 |
| GHSA-758m-6g3q-g3hh Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character |
Critical EPSS 4.20% |
< 0.7.1 | 0.7.1 |
| GHSA-c99h-fgqm-6679 UnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflow |
High EPSS 4.01% |
< 1.2.0 | 1.2.0 |
| GHSA-v7mf-qgxf-qmvf Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies |
Medium EPSS 2.13% |
< 0.6.3 | 0.6.3 |
| GHSA-vhxc-8jjq-859j Moderate severity vulnerability that affects org.apache.ranger:ranger |
Medium EPSS 2.07% |
< 0.6.2 | 0.6.2 |
| GHSA-rf7q-xqm3-6923 Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML |
Medium EPSS 2.10% |
< 0.6.1 | 0.6.1 |
| GHSA-4rjf-mxfm-98h5 SQL injection vulnerability in the policy admin tool in Apache Ranger |
High EPSS 1.88% |
< 0.5.3 | 0.5.3 |
| GHSA-j84c-j8qm-g47r The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password |
Critical EPSS 3.06% |
< 0.5.1 | 0.5.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor