Read the docs
TI-2024-30522 Aliases CVE-2024-45479GHSA-g9gf-g5jq-9h3v

Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost

Priority MEDIUM 48CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00687 52nd percentileScored 2026-11-07
Fix Fixed Apache Ranger (Apache Software Foundation): 2.5.0org.apache.ranger:ranger (Maven): 2.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Ranger2.4.0 to before 2.5.02.5.0Patch availableCNA
—org.apache.ranger:ranger (Maven)0.5.0 to before 2.5.02.5.0Patch availableGHSA-g9gf-g5jq-9h3v
  • Apache Ranger VendorApache Affected 2.4.0 to before 2.5.0 Fixed in 2.5.0 Patch available CNA
  • org.apache.ranger:ranger (Maven) Vendor— Affected 0.5.0 to before 2.5.0 Fixed in 2.5.0 Patch available GHSA-g9gf-g5jq-9h3v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:ranger:*:*:*:*:*:*:*:*2.4.0 to before 2.5.0VulnerableApache
  • cpe:2.3:a:apache:ranger:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.5.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Ranger (Apache Software Foundation) Fixed in 2.5.0
  • Fix · GHSA-g9gf-g5jq-9h3v org.apache.ranger:ranger (Maven) Fixed in 2.5.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Ranger 2.5.0

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-30521 Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user inputPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45479
  2. 2026-10-03 Alias added: GHSA-g9gf-g5jq-9h3v
  3. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 2

  • TI-2026-22888 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder CVSS 3.1CRITICAL 9.8
  • TI-2025-36701 Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator CVSS 3.1CRITICAL 9.8
  • TI-2026-40283 Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator CVSS 3.1CRITICAL 9.8
  • TI-2026-32358 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation CVSS 3.1CRITICAL 9.8
  • TI-2026-30817 Apache Ranger: Remote Code Execution via JDBC URL Injection CVSS 3.1CRITICAL 9.8
  • TI-2026-29575 Apache Ranger: Privilege Escalation via URL Parameter CVSS 3.1CRITICAL 9.8
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences