GitHub Advisoryadvisory · Maven

GHSA-86fh-j58m-7pf5 Improper Privilege Management in Apache Ozone

CRITICAL Published 2021-11-23 Modified 2024-01-31 Official page ↗
Aliases
CVE-2021-36372
Ecosystem
Maven
Packages
org.apache.ozone:ozone-main
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-273
Reviewed
2021-11-22

Affected packages

• Maven org.apache.ozone:ozone-main: < 1.2.0 → fixed in 1.2.0

Description

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

Related

Alias · CVE (1)

  • CVE-2021-36372 In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with… vulnerability

Weakness · CWE (1)

  • CWE-273 Improper Check for Dropped Privileges weakness

References