CVE-2020-17517: vulnerability in Apache Ozone
Ozone S3 Gateway allows bucket and key access to non authenticated users
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.3%
The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereby exposing data to anonymous clients or users. This affected Apache Ozone prior to the 1.1.0 release.
Affected products
Apache Software Foundation · Apache OzoneRelated CVEs — Apache Ozone
In the same product, most dangerous first.
CVE-2021-39236—Owners of the S3 tokens are not validatedEPSS 2.6%CVE-2021-36372—Original block tokens are persisted and can be retrievedEPSS 2.5%CVE-2021-41532—Unauthenticated access to Ozone Recon HTTP endpointsEPSS 2.4%CVE-2021-39233—Container-related datanode operations can be called without authorizationEPSS 2.4%CVE-2021-39231—Missing authentication/authorization on internal RPC endpointsEPSS 2.4%CVE-2021-39232—Missing admin check for SCM related admin commandsEPSS 1.7%