Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
The vulnerability (CWE-94 — improper control of code generation) consists of unsafe use of the Nashorn script engine, which allows injection and execution of untrusted code. An attacker can deliver a crafted payload over the network without needing any privileges or user interaction. The network attack vector (AV:N) with no required privileges (PR:N) and user interaction (UI:N) makes this vulnerability particularly dangerous.
An attacker can gain full control over the server, obtaining access to sensitive data, modifying it, or causing service unavailability (complete breach of confidentiality, integrity, and availability).
Apache Ranger should be updated as soon as possible to version 2.8.0, which contains a patch eliminating this vulnerability. Details available in the vendor's references: https://lists.apache.org/thread/z47q86rho80390lf2qcmoc2josvs0gtv
Apache Ranger versions 2.7.0 and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Ranger
APPApache< 2.8.0
Related vulnerabilities
CSV Injection w funkcji eksportu Apache Ranger (wersje < 2.6.0)
SSRF w Apache Ranger UI — podatność na stronie edycji usług
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like m...
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a passwo...
An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plu...