Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2016-8746

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true.

VectorNETWORK

PublishedJun 14, 2017, 17:29

Published Bysecurity@apache.org

Base Score

Score5.9

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.ranger:ranger-plugins-common(Maven)00.6.3N/A

References

http://www.securityfocus.com/bid/95998
https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

Weakness Type

CWE-426

CVSS Metrics

Base Score

5.9

Vector String

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Base SeverityMedium

Version

3.0

Attack Vector (AV)

NETWORK