Apache Software Foundation Apache Ranger vulnerabilities
13 known vulnerabilities affecting apache_software_foundation/apache_ranger.
Total CVEs
13
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL4HIGH2MEDIUM7
Vulnerabilities
Page 1 of 1
CVE-2025-59059CRITICALCVSS 9.8≤ 2.7.02026-03-03
CVE-2025-59059 [CRITICAL] CWE-94 CVE-2025-59059: Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versi
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
cvelistv5nvd
CVE-2025-59060MEDIUMCVSS 5.3≤ 2.7.02026-03-03
CVE-2025-59060 [MEDIUM] CWE-297 CVE-2025-59060: Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apa
Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
cvelistv5nvd
CVE-2024-55532CRITICALCVSS 9.8≤ 2.5.02025-03-03
CVE-2024-55532 [CRITICAL] CWE-1236 CVE-2024-55532: Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger
Improper Neutralization of Formula Elements in Export CSV feature of Apache Ranger in Apache Ranger Version < 2.6.0.
Users are recommended to upgrade to version 2.6.0, which fixes this issue.
cvelistv5nvd
CVE-2024-45479CRITICALCVSS 9.1≥ 2.4.0, < 2.5.02025-01-21
CVE-2024-45479 [CRITICAL] CWE-918 CVE-2024-45479: SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0.
Users ar
SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0.
Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.
cvelistv5nvd
CVE-2024-45478MEDIUMCVSS 4.8≥ 2.4.0, < 2.5.02025-01-21
CVE-2024-45478 [MEDIUM] CWE-79 CVE-2024-45478: Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0.
Us
Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0.
Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.
cvelistv5nvd
CVE-2022-45048HIGHCVSS 8.8v2.3.02023-05-05
CVE-2022-45048 [HIGH] CWE-74 CVE-2022-45048: Authenticated users with appropriate privileges can create policies having expressions that can expl
Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.
cvelistv5nvd
CVE-2019-12397MEDIUMCVSS 6.1v0.7.0 to 1.2.02019-08-08
CVE-2019-12397 [MEDIUM] CWE-79 CVE-2019-12397: Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting
Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.
cvelistv5nvd
CVE-2018-11778HIGHCVSS 8.8vprior to 1.2.02018-10-05
CVE-2018-11778 [HIGH] CWE-787 CVE-2018-11778: UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid
UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0
cvelistv5nvd
CVE-2016-6815MEDIUMCVSS 6.5v0.5.xv0.6.0+1 more2017-10-13
CVE-2016-6815 [MEDIUM] CWE-255 CVE-2016-6815: In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password f
In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.
cvelistv5nvd
CVE-2017-7676CRITICALCVSS 9.8v0.5.xv0.6.x+1 more2017-06-14
CVE-2017-7676 [CRITICAL] CWE-20 CVE-2017-7676: Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard characte
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.
cvelistv5nvd
CVE-2017-7677MEDIUMCVSS 5.9v0.5.xv0.6.x+1 more2017-06-14
CVE-2017-7677 [MEDIUM] CWE-862 CVE-2017-7677: In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before
In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.
cvelistv5nvd
CVE-2016-8746MEDIUMCVSS 5.9v0.6.0 - 0.6.22017-06-14
CVE-2016-8746 [MEDIUM] CWE-426 CVE-2016-8746: Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy
Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.
cvelistv5nvd
CVE-2016-8751MEDIUMCVSS 4.8v0.5.xv0.6.0 - 0.6.22017-06-14
CVE-2016-8751 [MEDIUM] CWE-79 CVE-2016-8751: Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom po
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.
cvelistv5nvd