Cross-Site Scripting in Apache Ranger's Policy Admin Tool
CVE-2016-5395

4.8MEDIUM

Key Information:

Vendor

Apache
Status
Ranger
Vendor
CVE Published:
26 September 2016

What is CVE-2016-5395?

A cross-site scripting (XSS) vulnerability exists in the user creation functionality of the policy admin tool in Apache Ranger prior to version 0.6.1. This flaw allows remote authenticated administrators to inject arbitrary web scripts or HTML into the application. The injection points are related to the handling of policies, which means that an attacker exploiting this vulnerability could execute malicious scripts in the context of a user session, potentially compromising user data and application integrity.

References

https://cwiki.apache.org/confluence/display/RANGER/Vulner...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/92577
vdb-entryx_refsource_BID

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.