VIR Vulnerability Intelligence Relay

CVE-2016-5395

medium
Published 2016-09-26 · Modified 2023-11-08
CVSS v3
4.8
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v2
3.5
VIR risk
4.8

Description

Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML

Predictions

Exploit likelihood
58%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

Package impact
EcosystemPackageVulnerableFixed
java Mavenorg.apache.ranger:ranger<0.6.10.6.1

Application impact
VendorProductVersionsFixed
apache apacheranger{"endIncluding":"0.5.0"}
apache apacheranger0.5.1
apache apacheranger0.5.2
apache apacheranger0.5.3
apache apacheranger0.6.0

References

CWEs

CWE-79

Verify integrity in audit chain (admin only). AS-IS.