CVE-2016-8751
MEDIUMApache Ranger <0.6.3 - XSS
Title source: llmDescription
Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.
Scores
CVSS v3
4.8
EPSS
0.0018
EPSS Percentile
38.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (4)
apache/ranger
< 0.6.3
org.apache.ranger/ranger
< 0.6.3Maven
Apache Software Foundation/Apache Ranger
< 0.5.x
Apache Software Foundation/Apache Ranger
< 0.6.0 - 0.6.2
Published
Jun 14, 2017
Tracked Since
Feb 18, 2026