Paper/Archive/CVE-2024-45479

CVE-2024-45479

Apache Software Foundation Apache Ranger — Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost

EPSS 0.7%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 52.7.527 × 2010.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.

Affected

ProductAffectedFixed inSource

Apache Ranger2.4.0 – < 2.5.02.5.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorycwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger refopenwall.com/lists/oss-security/2025/01/21/4