CVE-2016-5395

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.8MEDIUM
EPSS
0.1%
top 67.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Ranger
Timeline
PublishedSep 26
Latest updateOct 17

Description

Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶NVDapache/ranger0.5.0+4

🔴Vulnerability Details

3
GHSA
Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML↗2018-10-17
▶
OSV
Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML↗2018-10-17
▶
CVEList
CVE-2016-5395: Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0↗2016-09-26
▶