CVE-2016-0735
HighSummary
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
Risk Assessment
Organizations may be exposed to unauthorized access to resources, potentially leading to data leaks or security breaches.
Recommendation
It is recommended to upgrade Apache Ranger to version 0.5.2 or later to mitigate this vulnerability.
Other vulnerabilities in Apache Ranger
See all- CVE-2016-2174High
An SQL injection vulnerability in the policy admin tool in Apache Ranger before version 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter.
- CVE-2015-0266High
The Policy Admin Tool in Apache Ranger before version 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
- CVE-2026-55799Critical
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
- CVE-2026-44416Critical
Remote Code Execution via Arbitrary Class Instantiation in the plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-42537Critical
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-40920Critical
Privilege Escalation via URL Parameter in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-32227Critical
SQL Injection vulnerability in Apache Ranger. Users are recommended to upgrade to version 2.9.0, which fixes the issue.
- CVE-2026-28672Critical
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger, affecting versions from 0.6 through 2.8.
- CVE-2017-7676Critical
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character, which can result in unintended behavior.
- CVE-2016-0733Critical
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, allowing remote attackers to bypass authentication by leveraging knowledge of a valid username.
Original NVD description (English source)
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.