Read the docs
TI-2024-30521 Aliases CVE-2024-45478GHSA-vrx2-mgr9-v67h

Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00607 49th percentileScored 2026-11-07
Fix Fixed Apache Ranger (Apache Software Foundation): 2.5.0org.apache.ranger:ranger (Maven): 2.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Ranger2.4.0 to before 2.5.02.5.0Patch availableCNA
—org.apache.ranger:ranger (Maven)before 2.5.02.5.0Patch availableGHSA-vrx2-mgr9-v67h
  • Apache Ranger VendorApache Affected 2.4.0 to before 2.5.0 Fixed in 2.5.0 Patch available CNA
  • org.apache.ranger:ranger (Maven) Vendor— Affected before 2.5.0 Fixed in 2.5.0 Patch available GHSA-vrx2-mgr9-v67h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:ranger:*:*:*:*:*:*:*:*2.4.0 to before 2.5.0VulnerableApache
  • cpe:2.3:a:apache:ranger:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.5.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Ranger (Apache Software Foundation) Fixed in 2.5.0
  • Fix · GHSA-vrx2-mgr9-v67h org.apache.ranger:ranger (Maven) Fixed in 2.5.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Ranger 2.5.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-30522 Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhostPriority MEDIUM 48
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45478
  2. 2026-10-03 Alias added: GHSA-vrx2-mgr9-v67h

References

Advisory 3

Other 1

  • TI-2026-22888 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder CVSS 3.1CRITICAL 9.8
  • TI-2025-36701 Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator CVSS 3.1CRITICAL 9.8
  • TI-2026-40283 Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator CVSS 3.1CRITICAL 9.8
  • TI-2026-32358 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation CVSS 3.1CRITICAL 9.8
  • TI-2026-30817 Apache Ranger: Remote Code Execution via JDBC URL Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-29575 Apache Ranger: Privilege Escalation via URL Parameter CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences