CVE-2021-39234CWE-20

CVE-2021-39234: fallo en Apache Ozone

Raw block data can be read bypassing ACL/authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Ozone+ Monitorear org.apache.ozone:ozone-main

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.4%
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
Productos afectados
Apache Software Foundation · Apache Ozone
CVEs relacionadas — Apache Ozone

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-39236—Owners of the S3 tokens are not validatedEPSS 2.6%CVE-2021-36372—Original block tokens are persisted and can be retrievedEPSS 2.5%CVE-2021-41532—Unauthenticated access to Ozone Recon HTTP endpointsEPSS 2.4%CVE-2021-39233—Container-related datanode operations can be called without authorizationEPSS 2.4%CVE-2021-39231—Missing authentication/authorization on internal RPC endpointsEPSS 2.4%CVE-2020-17517—Ozone S3 Gateway allows bucket and key access to non authenticated usersEPSS 2.3%