Open-source package vulnerability · Maven
CVE-2024-45479: Apache Ranger UI vulnerable to Server Side Request Forgery
criticalCVSS 3.1 9.1GHSA-g9gf-g5jq-9h3v
SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.
Published Jan 22, 2025 · Updated Aug 31, 2026
Affected packages
org.apache.ranger:ranger
- Ecosystem
- Maven
- Affected
- >= 0.5.0, < 2.5.0
- Fixed in
- 2.5.0
- Check
mvn dependency:tree -Dincludes=org.apache.ranger:ranger
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.
Credited to sealbenb.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-45479
- https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger
- https://github.com/apache/ranger/commit/447658578decf33d2b68d872a32db59227dfef1b#diff-0cb27d5067c1eced82c6a8a755e6142d20c633820996701a1ca616345ea8b1ca
- https://github.com/advisories/GHSA-g9gf-g5jq-9h3v
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology