Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.ranger:ranger

17 known vulnerabilities (2 critical, 1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
2.9.0 (Aug 5, 2026): no advisory affects it
Newest unaffected release
2.9.0 (Aug 5, 2026), the latest release
Advisories
17 · 2 critical, 1 high, 1 medium
Dependents
0
Releases
19 since 0.6.0 (Jul 19, 2016)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Show all 17 advisoriesShow fewer advisories
  • CVE-2016-0733
    No published release is affected
    No published release is affected
  • CVE-2015-5167
    No published release is affected
    No published release is affected
  • CVE-2016-0735
    No published release is affected
    No published release is affected
  • CVE-2015-0266
    No published release is affected
    No published release is affected
  • CVE-2015-0265
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • CVE-2026-28672Critical 9.8

    Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

    Affected: from 0.6.0, through 2.8.0.

    Fixed in 2.9.0 (released Aug 5, 2026, 5 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 2.9.0, is not affected.

  • CVE-2024-45479Critical 9.1

    Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost

    Affected: from 0.5.0, fixed in 2.5.0.

    Fixed in 2.5.0 (released Aug 7, 2024, 167 days before disclosure).

    The latest release, 2.9.0, is not affected.

  • CVE-2024-45478Medium 4.8

    Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input

    Affected: fixed in 2.5.0.

    Fixed in 2.5.0 (released Aug 7, 2024, 167 days before disclosure).

    The latest release, 2.9.0, is not affected.

  • Apache Ranger: code execution vulnerability in policy expressions

    Affected: from 2.3.0, fixed in 2.4.0.

    Fixed in 2.4.0 (released Mar 31, 2023, 35 days before disclosure).

    The latest release, 2.9.0, is not affected.

  • Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue.

    Affected: from 0.7.0, fixed in 2.0.0.

    Fixed in 2.0.0 (released Aug 7, 2019, 1 day before disclosure).

    The latest release, 2.9.0, is not affected.

  • UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow.

    Affected: fixed in 1.2.0.

    Fixed in 1.2.0 (released Oct 4, 2018, 1 day before disclosure).

    The latest release, 2.9.0, is not affected.

  • In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.

    Affected: fixed in 0.6.2.

    Fixed in 0.6.2 (released Nov 9, 2016, 338 days before disclosure).

    The latest release, 2.9.0, is not affected.

  • In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX…

    Affected: fixed in 0.7.1.

    Fixed in 0.7.1 (released Jun 7, 2017, 7 days before disclosure).

    The latest release, 2.9.0, is not affected.

  • Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt.

    Affected: fixed in 0.7.1.

    Fixed in 0.7.1 (released Jun 7, 2017, 7 days before disclosure).

    The latest release, 2.9.0, is not affected.

  • Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions.

    Affected: fixed in 0.6.3.

    Fixed in 0.6.3 (released Jan 31, 2017, 134 days before disclosure).

    The latest release, 2.9.0, is not affected.

  • Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows…

    Affected: fixed in 0.6.1.

    Fixed in 0.6.1 (released Aug 25, 2016, 32 days before disclosure).

    The latest release, 2.9.0, is not affected.

  • SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute…

    Affected: fixed in 0.5.3.

    Fixed in 0.6.0 (released Jul 19, 2016, 36 days after disclosure, the advisory names 0.5.3, which was never published).

    The latest release, 2.9.0, is not affected.

  • The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote…

    Affected: fixed in 0.5.1.

    Fixed in 0.6.0 (released Jul 19, 2016, 98 days after disclosure, the advisory names 0.5.1, which was never published).

    The latest release, 2.9.0, is not affected.

  • The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST…

    Affected: fixed in 0.5.1.

    Fixed in 0.6.0 (released Jul 19, 2016, 98 days after disclosure, the advisory names 0.5.1, which was never published).

    The latest release, 2.9.0, is not affected.

  • Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by…

    Affected: from 0.5.0, fixed in 0.5.2.

    Fixed in 0.6.0 (released Jul 19, 2016, 99 days after disclosure, the advisory names 0.5.2, which was never published).

    The latest release, 2.9.0, is not affected.

Show all 17 advisoriesShow fewer advisories

  • The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct…

    Affected: fixed in 0.5.0.

    Fixed in 0.6.0 (released Jul 19, 2016, 99 days after disclosure, the advisory names 0.5.0, which was never published).

    The latest release, 2.9.0, is not affected.

  • Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject…

    Affected: fixed in 0.5.0.

    Fixed in 0.6.0 (released Jul 19, 2016, 99 days after disclosure, the advisory names 0.5.0, which was never published).

    The latest release, 2.9.0, is not affected.