Description

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.

Remediation

References

http://www.securityfocus.com/bid/94221

https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

Related Vulnerabilities

CVE-2022-23913 Vulnerability in maven package org.apache.activemq:artemis-commons

CVE-2022-25940 Vulnerability in npm package lite-server

CVE-2020-7642 Vulnerability in maven package org.webjars.bower:lazysizes

CVE-2019-10805 Vulnerability in npm package valib

CVE-2020-7596 Vulnerability in npm package codecov

Severity

High

Classification

CWE-255 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Third Party Advisory VDB Entry Vendor Advisory