Apache Ozone user impersonation due to non-validation of Ozone S3 tokens
In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-39236US | high8.8OT elevated | — | ||
In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user. | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2021/11/19/7WEB
- https://github.com/apache/ozonePACKAGE
- https://github.com/apache/ozone/commit/60e078729e18ef1be276f35659957ac553d266f7WEB
- https://github.com/apache/ozone/pull/1871WEB
- https://issues.apache.org/jira/browse/HDDS-4763WEB
- https://lists.apache.org/thread/q0lhspolnwfbsw33w98b7b1923n1np4dWEB
- https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C0fd74baa-88a0-39a2-8f3a-b982acb25d5a%40apache.org%3EWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-39236ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan