CVEvulnerability

CVE-2021-39234

6.8 MEDIUM Published 2021-11-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-11-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
4.9 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:N
Weaknesses
CWE-20, CWE-863

Description

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.

Affected configurations

• apache ozone (< 1.2.0)

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-863 Incorrect Authorization weakness

References