{"id":"CVE-2019-12397","aliases":["EUVD-2019-0633","GHSA-fpqp-v323-44xv"],"status":"published","title":"Cross-site scripting in Apache Ranger","description":"Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02965,"percentile":0.87315,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-08-08T17:06:43Z","modified":"2026-10-24T10:30:19Z","fixes":[{"ecosystem":"Maven","package":"org.apache.ranger:ranger","fixed_in":["2.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.ranger:ranger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"last_affected":"1.2.0"},{"fixed":"2.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.ranger:ranger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"2.0.0"}]}],"versions":["0.7.0","0.7.1","1.0.0","1.1.0","1.2.0"]}],"products":[{"vendor":"apache","product":"ranger"},{"vendor":"apache software foundation","product":"apache ranger"}],"references":[{"url":"https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2019/08/08/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/ab2de1adad96f5dbd19d976b28715dfc60dbe75e82a74f48be8ef695%40%3Cdev.ranger.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/cbc6346708ef2b9ffb2555637311bf6294923c609c029389fa39de8f%40%3Cdev.ranger.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r04bc435a92911de4b52d2b98f169bd7cf2e8bbeb53b03788df8f932c%40%3Cdev.ranger.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd88077a781ef38f7687c100f93992f4dda8aa101925050c4af470998%40%3Cdev.ranger.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12397","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/ab2de1adad96f5dbd19d976b28715dfc60dbe75e82a74f48be8ef695@%3Cdev.ranger.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/cbc6346708ef2b9ffb2555637311bf6294923c609c029389fa39de8f@%3Cdev.ranger.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fpqp-v323-44xv"}],"sources":{"cve":[{"id":"CVE-2019-12397","description":"Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.","status":"published","published":"2019-08-08T17:06:43Z","modified":"2024-08-04T23:17:40.107Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-0633","description":"Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.","status":"published","published":"2019-08-08T17:06:43Z","modified":"2024-08-04T23:17:40Z","updated_at":"2026-11-03T02:40:45.973526Z"}],"ghsa":[{"id":"GHSA-fpqp-v323-44xv","title":"Cross-site scripting in Apache Ranger","description":"Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.","status":"published","published":"2019-08-16T14:01:35Z","modified":"2023-02-01T05:02:22Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:30.61364Z"}],"nvd":[{"id":"CVE-2019-12397","description":"Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.","status":"published","published":"2019-08-08T18:15:10.663Z","modified":"2026-06-17T02:14:33.88Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"CVE-2019-12397","description":"Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.","status":"published","published":"2019-08-08T18:15:10.663Z","modified":"2026-10-24T10:30:19.378286694Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"GHSA-fpqp-v323-44xv","title":"Cross-site scripting in Apache Ranger","description":"Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.","status":"published","published":"2019-08-16T14:01:35Z","modified":"2023-11-08T04:01:03.869656Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}