GHSA-g9gf-g5jq-9h3v

Apache Ranger UI vulnerable to Server Side Request Forgery

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-45479

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.ranger:ranger	>= 0.5.0, < 2.5.0	2.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-45479 advisory
https://github.com/apache/ranger/commit/447658578decf33d2b68d872a32db59227dfef1b#diff-0cb27d5067c1eced82c6a8a755e6142d20c633820996701a1ca616… web
https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger web
https://github.com/apache/ranger package
http://www.openwall.com/lists/oss-security/2025/01/21/4 web