7.2high
CVE-2016-2174
SQL injection vulnerability in the policy admin tool in Apache Ranger
Also known as GHSA-4rjf-mxfm-98h5
Published 10 y ago · modified 4 mo ago · JSON
CVSS
7.2
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
0
none known
Summary
SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
Exploit prediction (EPSS)
1.88% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.ranger:ranger | <0.5.3 | 0.5.3 |
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- openwall.com /lists/oss-security/2016/06/01/3 · mailing-list, x_refsource_MLIST, x_transferred
- cwiki.apache.org /confluence/display/RANGER/Vulnerabilities+found+in+Ranger · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-2174 · advisory
- github.com /advisories/GHSA-4rjf-mxfm-98h5 · advisory
Sources
- CVE List: CVE-2016-2174
- GitHub Advisory: GHSA-4rjf-mxfm-98h5
- NVD: CVE-2016-2174
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.