CVE-2020-17533: vulnerability in Apache Accumulo
Apache Accumulo Improper Handling of Insufficient Permissions
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Apache Accumulo fails to properly verify user permissions before allowing certain admin operations like flushing tables or shutting down the system. An authenticated user without proper permissions can bypass security checks and perform these sensitive actions anyway.
The application does not validate return values from 'canFlush' and 'canPerformSystemActions' security functions before executing privileged operations. An authenticated attacker can exploit this improper error handling (CWE-252) to perform unauthorized administrative actions including table flushing, system shutdown, and configuration modification.
In the same product, most dangerous first.