{"id":"CVE-2024-45478","summary":"Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input","details":"Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0.\nUsers are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue.","aliases":["GHSA-vrx2-mgr9-v67h"],"modified":"2026-08-12T03:51:35.404326103Z","published":"2025-01-21T21:25:58.276Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"2.4.0"},{"fixed":"2.5.0"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"apache","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45478.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/01/21/3"},{"type":"ADVISORY","url":"https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45478.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45478"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/ranger","events":[{"introduced":"50ad9c19e62f5aa6b2888b17437aa6fb1e2c0a36"},{"fixed":"f3e2a44f0d7f80be4eed95b456f5066089a88891"}],"database_specific":{"extracted_events":[{"introduced":"2.4.0"},{"fixed":"2.5.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:apache:ranger:*:*:*:*:*:*:*:*"}}],"versions":["release-2.5.0-rc3","release-2.5.0-rc2","release-2.5.0-rc1","release-2.5.0-rc0","release-ranger-2.4.0","release-2.4.0-rc2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45478.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}