CVE-2016-8751

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Score

CVSS 3.0 4.8 Medium

Status

Modified - security@apache.org

Published

2017-06-14

Last modified

2024-08-06

Weaknesses

CWE-79

Affected products

• Ranger (Apache)
• Apache Ranger (Apache Software Foundation)

References

• http://www.securityfocus.com/bid/99067
• https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger