Cross-Site Scripting Vulnerability in Apache Ranger Affected Versions
CVE-2019-12397

6.1MEDIUM

Key Information:

Vendor
Apache
Status
Apache Ranger
Vendor
CVE Published:
8 August 2019

Summary

Apache Ranger versions 0.7.0 to 1.2.0 have a vulnerability in their policy import functionality that allows for cross-site scripting (XSS) attacks. An attacker could exploit this flaw to inject malicious scripts, potentially compromising user data or session information. Users are strongly advised to upgrade to Apache Ranger version 2.0.0 or later, where this issue has been resolved.

Affected Version(s)

Apache Ranger 0.7.0 to 1.2.0

References

https://cwiki.apache.org/confluence/display/RANGER/Vulner...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2019/08/08/1
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ab2de1adad96f5dbd19d...
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.