SQL Injection Affecting org.apache.ranger:ranger package, versions [,0.5.3)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.13% (50th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about SQL Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-ORGAPACHERANGER-31472
  • published31 Aug 2017
  • disclosed12 Apr 2016
  • creditUnknown

Introduced: 12 Apr 2016

CVE-2016-2174  (opens in a new tab)
CWE-89  (opens in a new tab)

How to fix?

Upgrade org.apache.ranger:ranger to version 0.5.3 or higher.

Overview

org.apache.ranger:ranger is a framework to enable, monitor and manage comprehensive data security across the Hadoop platform.

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.

CVSS Scores

version 3.1