Description

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.

Remediation

References

http://www.securityfocus.com/bid/76221

http://www.slideshare.net/wojdwo/big-problems-with-big-data-hadoop-interfaces-security

https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

https://mail-archives.apache.org/mod_mbox/ranger-dev/201508.mbox/%3CD1E7EC30.9D53F%25vel%40apache.org%3E

Related Vulnerabilities

CVE-2023-34603 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-parent

CVE-2022-43424 Vulnerability in maven package com.compuware.jenkins:compuware-xpediter-code-coverage

CVE-2020-36377 Vulnerability in npm package aaptjs

CVE-2023-34465 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authorization-bridge

CVE-2021-42697 Vulnerability in maven package com.typesafe.akka:akka-http_2.12

Severity

High

Classification

CWE-264 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Tags

Exploit Vendor Advisory