CVE-2016-2174

high

Description

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.

References

https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger

http://www.openwall.com/lists/oss-security/2016/06/01/3

Details

Source: Mitre, NVD

Published: 2016-06-13

Updated: 2026-05-06

Risk Information

CVSS v2

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00576

Detections

Analytics