CVE-2021-39232: vulnerability in Apache Ozone
Missing admin check for SCM related admin commands
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.7%
In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.
Affected products
Apache Software Foundation · Apache OzoneRelated CVEs — Apache Ozone
In the same product, most dangerous first.
CVE-2021-39236—Owners of the S3 tokens are not validatedEPSS 2.6%CVE-2021-36372—Original block tokens are persisted and can be retrievedEPSS 2.5%CVE-2021-41532—Unauthenticated access to Ozone Recon HTTP endpointsEPSS 2.4%CVE-2021-39233—Container-related datanode operations can be called without authorizationEPSS 2.4%CVE-2021-39231—Missing authentication/authorization on internal RPC endpointsEPSS 2.4%CVE-2020-17517—Ozone S3 Gateway allows bucket and key access to non authenticated usersEPSS 2.3%