CVE-2024-45478: Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input
Published Jan 21, 2025
·Updated
Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.
Affected Software
3 affected componentsFixes available
Apache Ranger
Apache Ranger>=2.4.0<2.5.0
maven/org.apache.ranger:ranger<2.5.0
2.5.0
Event History
Jan 21, 2025
CVE Published
via MITRE·09:25 PM
Data Sourced
via MITRE·09:25 PM
DescriptionWeakness
Jan 22, 2025
Advisory Published
via GitHub·12:33 AM
Data Sourced
via GitHub·12:33 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-45478?
CVE-2024-45478 is classified as a stored XSS vulnerability, which can lead to significant security implications.
2
How do I fix CVE-2024-45478?
To fix CVE-2024-45478, users should upgrade to Apache Ranger version 2.5.0 or later.
3
What software is affected by CVE-2024-45478?
CVE-2024-45478 affects Apache Ranger versions from 2.4.0 up to, but not including, 2.5.0.
4
What type of attack does CVE-2024-45478 enable?
CVE-2024-45478 enables stored cross-site scripting (XSS) attacks in the Edit Service Page of Apache Ranger UI.
5
Is there a workaround for CVE-2024-45478?
There is no recommended workaround for CVE-2024-45478; upgrading to a patched version is advised.