CVE-2022-45048: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

July 6, 2023

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.

References

github.com/advisories/GHSA-89gw-cffj-mqg9
lists.apache.org/thread/6rpzwy1smdhr60tsh1ydknn3kdm45bb6
nvd.nist.gov/vuln/detail/CVE-2022-45048

Code Behaviors & Features

Detect and mitigate CVE-2022-45048 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →