CVE-2024-45478

Published Jan 21, 2025

Last updated 9 months ago

CVSS medium 4.8

Overview

Description: Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.
Source: security@apache.org
NVD status: Analyzed
Products: ranger

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.8
Impact score: 2.7
Exploitability score: 1.7
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

security@apache.org: CWE-20
nvd@nist.gov: CWE-79

Hype score: Not currently trending

CVE-2024-45478: Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input https://t.co/GEXQiLMQM4 CVE-2024-45479: Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost https://t.co/69QwH6efkR
@oss_security
21 Jan 2025
136 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:ranger:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "94B04266-A8E8-478F-9340-1B9D6BCD84FA",
            "versionEndExcluding": "2.5.0",
            "versionStartIncluding": "2.4.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References