CVE-2021-41532CWE-200

CVE-2021-41532: vulnerability in Apache Ozone

Unauthenticated access to Ozone Recon HTTP endpoints

Published · Updated

Follow this CVE+ Monitor Apache Ozone+ Monitor org.apache.ozone:ozone-main

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 2.4%
In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
Affected products
Apache Software Foundation · Apache Ozone
Related CVEs — Apache Ozone

In the same product, most dangerous first.

CVE-2021-39236—Owners of the S3 tokens are not validatedEPSS 2.6%CVE-2021-36372—Original block tokens are persisted and can be retrievedEPSS 2.5%CVE-2021-39233—Container-related datanode operations can be called without authorizationEPSS 2.4%CVE-2021-39231—Missing authentication/authorization on internal RPC endpointsEPSS 2.4%CVE-2020-17517—Ozone S3 Gateway allows bucket and key access to non authenticated usersEPSS 2.3%CVE-2021-39232—Missing admin check for SCM related admin commandsEPSS 1.7%