Skip to content
OpenAdvisories
High · 7.2 CVE-2016-2174 EUVD-2018-0505GHSA-4rjf-mxfm-98h5

SQL injection vulnerability in the policy admin tool in Apache Ranger

Published Jun 13, 2016 · Updated Aug 5, 2024 · Assigned by redhat

Description

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.ranger:ranger < 0.5.3 0.5.3 GHSA-4rjf-mxfm-98h5

References