Description

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.

Remediation

References

http://www.securityfocus.com/bid/82871

https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

https://issues.apache.org/jira/browse/RANGER-835

https://mail-archives.apache.org/mod_mbox/ranger-dev/201602.mbox/%3CD2D9A4C5.114ECA%25vel%40apache.org%3E

Related Vulnerabilities

CVE-2014-8110 Vulnerability in maven package org.apache.activemq:activemq-web-console

CVE-2021-36738 Vulnerability in maven package org.apache.portals.pluto.demo:applicant-mvcbean-cdi-jsp-portlet

CVE-2023-49655 Vulnerability in maven package org.jenkins-ci.plugins:matlab

CVE-2023-37948 Vulnerability in maven package org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute

CVE-2012-2379 Vulnerability in maven package org.apache.cxf:cxf-bundle-minimal

Severity

Critical

Classification

CWE-287 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory