CVE-2015-0266

Published: Apr 11, 2016Modified: May 6, 2026

7.1

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.

Affected (1)

Products: Apache: Ranger

Apache

1 product

Ranger

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Ranger	Up to 0.4.0.

Related CWEs

CWE-264

References (8)

http://www.securityfocus.com/bid/76221

Source: secalert@redhat.com

http://www.slideshare.net/wojdwo/big-problems-with-big-data-hadoop-interfaces-security

Source: secalert@redhat.com

Exploit

https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

Source: secalert@redhat.com

Vendor Advisory

https://mail-archives.apache.org/mod_mbox/ranger-dev/201508.mbox/%3CD1E7EC30.9D53F%25vel%40apache.org%3E

Source: secalert@redhat.com

http://www.securityfocus.com/bid/76221

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.slideshare.net/wojdwo/big-problems-with-big-data-hadoop-interfaces-security

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://mail-archives.apache.org/mod_mbox/ranger-dev/201508.mbox/%3CD1E7EC30.9D53F%25vel%40apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.