CVE-2021-39234CWE-20

CVE-2021-39234: falha em Apache Ozone

Raw block data can be read bypassing ACL/authorization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Ozone+ Monitorar org.apache.ozone:ozone-main

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.4%
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
Produtos afetados
Apache Software Foundation · Apache Ozone
CVEs relacionadas — Apache Ozone

No mesmo produto, das mais perigosas para as menos.

CVE-2021-39236—Owners of the S3 tokens are not validatedEPSS 2.6%CVE-2021-36372—Original block tokens are persisted and can be retrievedEPSS 2.5%CVE-2021-41532—Unauthenticated access to Ozone Recon HTTP endpointsEPSS 2.4%CVE-2021-39233—Container-related datanode operations can be called without authorizationEPSS 2.4%CVE-2021-39231—Missing authentication/authorization on internal RPC endpointsEPSS 2.4%CVE-2020-17517—Ozone S3 Gateway allows bucket and key access to non authenticated usersEPSS 2.3%