GHSA-c8cw-2c5j-xff3

ghsaUSosv

Incorrect Authorization in Apache Ozone

view advisory published 2021-11-23Licence: CC-BY-4.0

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-39234US	medium6.8OT elevated	1.41% (73rd)	—	2021-11-19
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security c…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2021/11/19/5WEB
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C97d65498-7f8c-366f-1bea-5a74b6378f0d%40apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-39234ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan