GitHub Advisoryadvisory · Maven

GHSA-c6j7-4fr9-c76p Incorrect permissions in Apache Ozone

MEDIUM Published 2021-11-23 Modified 2023-11-14 Official page ↗
Aliases
CVE-2021-39235
Ecosystem
Maven
Packages
org.apache.ozone:ozone-main
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-732
Reviewed
2021-11-22

Affected packages

• Maven org.apache.ozone:ozone-main: < 1.2.0 → fixed in 1.2.0

Description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

Related

Alias · CVE (1)

  • CVE-2021-39235 In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References