{"id":"CVE-2022-45048","summary":"Apache Ranger: code execution vulnerability in policy expressions","details":"Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.\n\n\n","aliases":["GHSA-89gw-cffj-mqg9"],"modified":"2026-08-12T03:51:49.498873930Z","published":"2023-05-05T07:50:25.762Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-74"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45048.json","unresolved_ranges":[{"extracted_events":[{"introduced":"2.3.0"},{"last_affected":"2.3.0"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45048.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/6rpzwy1smdhr60tsh1ydknn3kdm45bb6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45048"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/ranger","events":[{"introduced":"ce3339c8ab653d99382caba9b2e5f306a7118561"},{"last_affected":"ce3339c8ab653d99382caba9b2e5f306a7118561"}],"database_specific":{"extracted_events":[{"introduced":"2.3.0"},{"last_affected":"2.3.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:apache:ranger:2.3.0:*:*:*:*:*:*:*"}}],"versions":["2.3.0","release-ranger-2.3.0","release-2.3.0-rc3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-45048.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"}]}