CVE-2016-6815

MEDIUM

Apache Ranger < 0.6.2 - Unauthorized Password Change for Admin Users

Title source: llm

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

Vendor Advisory x_refsource_confirm

CVSS v3 6.5

EPSS 0.0049

EPSS Percentile 65.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-255

Status published

Products (11)

apache/ranger 0.4.0

apache/ranger 0.5.0

apache/ranger 0.5.1

apache/ranger 0.5.2

apache/ranger 0.5.3

apache/ranger 0.6.0

apache/ranger 0.6.1

Apache Software Foundation/Apache Ranger 0.5.x

Apache Software Foundation/Apache Ranger 0.6.0

Apache Software Foundation/Apache Ranger 0.6.1

... and 1 more

Published Oct 13, 2017

Tracked Since Feb 18, 2026