Description

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.

Remediation

References

http://www.openwall.com/lists/oss-security/2016/06/01/3

https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

Related Vulnerabilities

CVE-2020-5427 Vulnerability in maven package org.springframework.cloud:spring-cloud-dataflow-server-core

CVE-2023-34603 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-parent

CVE-2023-34602 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

CVE-2023-30867 Vulnerability in maven package org.apache.streampark:streampark

CVE-2023-38905 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

CWE-89