CVE-2020-17533

mediumpriority · track · 43EPSS 0.037 · 90 %ileexploit · PoCEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

3.70% (90th) EPSS

CVSS 5.5 · medium

Is it mine?

6 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.5–8.1

v2.05.5mediumAV:N/AC:L/Au:S/C:N/I:P/A:Pprimary · NVD / NIST USexploitability 8 · impact 4.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.2

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hsecondary · OSV

v3.17.7highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-252USCWE-252USCWE-280USCWE-732US

exploits (1)

Public proof-of-concept and weaponised exploit code.

pazeray/CVE-2020-17533pazeray/CVE-2020-17533PoC · poc_in_github

affected products (6)

Products and version ranges known to be affected.

Apache Software Foundation Apache Accumulo≤ Apache Accumulo 2.0.0enisa_euvdEU
Apache Software Foundation Apache Accumulo1.5.0 → Apache Accumulo*enisa_euvdEU
apache accumulo1.5.0 → 1.10.0nvdUScpe:2.3:a:apache:accumulo:*:*:*:*:*:*:*:*
apache accumulo= 2.0.0nvdUScpe:2.3:a:apache:accumulo:*:*:*:*:*:*:*:*
Maven org.apache.accumulo:accumulo-master1.5.0 → 1.10.1osvUSpkg:maven/org.apache.accumulo/accumulo-master
Maven org.apache.accumulo:accumulo-master2.0.0 → 2.0.1osvUSpkg:maven/org.apache.accumulo/accumulo-master

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-grc3-8q8m-4j7cImproper privilege handling in Apache Accumulo2022-02-09ghsa · osvUS
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2020-12-29modified 2026-06-17

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan