CVE-2022-45048 Apache Ranger: code execution vulnerability in policy expressions

What is CVE-2022-45048?

CVE-2022-45048 is a high-severity code injection vulnerability in Apache Ranger, published on 5 May 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.

Weakness: CWE-74

Which versions are affected by CVE-2022-45048?

2 open source packages ship an affected version, including org.apache.ranger:ranger. It affects 1 product.

Products include Apache Ranger.

How do I fix CVE-2022-45048?

Upgrade org.apache.ranger:ranger to 2.4.0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-45048 being exploited?

There is no known exploitation of CVE-2022-45048 in the wild and no public exploit code.

Other vulnerabilities in Apache Ranger

• CVE-2026-28672 Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder Critical 9.8
• CVE-2026-32227 Apache Ranger: SQL Injection vulnerability in lookup functionality Critical 9.8
• CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter Critical 9.8
• CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection Critical 9.8
• CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-89gw-cffj-mqg9.