cve.bz

CVE-2016-0733

9.8 criticalEPSS 3.1%

Critical (9.8) in apache ranger. EPSS 3.1% chance of exploitation in the next 30 days. Fixed in org.apache.ranger:ranger 0.5.1.

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.

Severity

CVSS 3.0

9.8 critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
3.1% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j84c-j8qm-g47rMavenorg.apache.ranger:ranger<0.5.10.5.1

References

Check your stackJSON