CVE-2021-36372: falha em Apache Ozone
Original block tokens are persisted and can be retrieved
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 2.5%
In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
Produtos afetados
Apache Software Foundation · Apache OzoneCVEs relacionadas — Apache Ozone
No mesmo produto, das mais perigosas para as menos.
CVE-2021-39236—Owners of the S3 tokens are not validatedEPSS 2.6%CVE-2021-41532—Unauthenticated access to Ozone Recon HTTP endpointsEPSS 2.4%CVE-2021-39233—Container-related datanode operations can be called without authorizationEPSS 2.4%CVE-2021-39231—Missing authentication/authorization on internal RPC endpointsEPSS 2.4%CVE-2020-17517—Ozone S3 Gateway allows bucket and key access to non authenticated usersEPSS 2.3%CVE-2021-39232—Missing admin check for SCM related admin commandsEPSS 1.7%