Every CVESearch/Get API key

CVE-2016-8751

Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies

4.8 MediumFix available

CVE-2016-8751 is a medium vulnerability (CVSS 4.8) in Apache Ranger, published June 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in org.apache.ranger:ranger 0.6.3.

What does this mean?
Severity
4.8 MediumCVSS 3.0, NVD
Exploit chance
2.13%EPSS, 82nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.6.3org.apache.ranger:ranger +2 more

Description

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

2.13%Up 1.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.ranger:ranger
Maven
before 0.6.3
0.6.3
org.apache.ranger:ranger
Maven
before 0.6.3, plus listed versions
0.6.00.6.10.6.2
0.6.3
jasper
Mageia:5
From an advisory covering 39 CVEs
before 1.900.23-1.mga5
1.900.23-1.mga5

What each source reports

NVD Score used4.8

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Record
CVE-2016-8751
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE ListNo score

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Record
CVE-2016-8751
Updated
2026-11-02
EUVDEUVD-2018-0694No score

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Record
EUVD-2018-0694
Updated
2026-11-03
GitHub AdvisoriesGHSA-v7mf-qgxf-qmvf4.8

Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies

Apache Ranger before 0.6.is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Record
GHSA-v7mf-qgxf-qmvf
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV4.8

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Record
CVE-2016-8751
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-v7mf-qgxf-qmvf4.8

Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies

Apache Ranger before 0.6.is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.

Record
GHSA-v7mf-qgxf-qmvf
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVMGASA-2017-0474No score

Updated jasper packages fix security vulnerabilities

The jasper package has been updated and patched to fix several security issues.

Record
MGASA-2017-0474
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 7 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open