Policy Engine Path Matching Flaw in Apache Ranger
CVE-2016-8746

5.9MEDIUM

Key Information:

Vendor
Apache
Status
Apache Ranger
Vendor
CVE Published:
14 June 2017

Summary

The policy engine in Apache Ranger prior to version 0.6.3 incorrectly handles certain path matching configurations, especially when policies lack wildcards and the recursion flag is enabled. This flaw may lead to unauthorized access or unintended exposure of sensitive data, compromising the integrity of the security policies configured within the application.

Affected Version(s)

Apache Ranger 0.6.0 - 0.6.2

References

http://www.securityfocus.com/bid/95998
vdb-entryx_refsource_BID
https://cwiki.apache.org/confluence/display/RANGER/Vulner...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.