CVE-2021-39233CWE-306

CVE-2021-39233: fallo en Apache Ozone

Container-related datanode operations can be called without authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Ozone+ Monitorear org.apache.ozone:ozone-main

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 2.4%
In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
Productos afectados
Apache Software Foundation · Apache Ozone
CVEs relacionadas — Apache Ozone

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-39236—Owners of the S3 tokens are not validatedEPSS 2.6%CVE-2021-36372—Original block tokens are persisted and can be retrievedEPSS 2.5%CVE-2021-41532—Unauthenticated access to Ozone Recon HTTP endpointsEPSS 2.4%CVE-2021-39231—Missing authentication/authorization on internal RPC endpointsEPSS 2.4%CVE-2020-17517—Ozone S3 Gateway allows bucket and key access to non authenticated usersEPSS 2.3%CVE-2021-39232—Missing admin check for SCM related admin commandsEPSS 1.7%