CVE-2016-8746

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.

Score

CVSS 3.0 5.9 Medium

Status

Modified - security@apache.org

Published

2017-06-14

Last modified

2024-08-06

Weaknesses

CWE-426

Affected products

• Ranger (Apache)
• Apache Ranger (Apache Software Foundation)

References

• http://www.securityfocus.com/bid/95998
• https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger