by Kastro
Paper/Archive/CVE-2021-39233

CVE-2021-39233

Apache Software Foundation Apache Ozone — Container-related datanode operations can be called without authorization

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 83.8.838 × 2016.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.

Affected

ProductAffectedFixed inSource
Apache Ozone1.1 – 1.1–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refmail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3Erefopenwall.com/lists/oss-security/2021/11/19/4