GitHub Advisoryadvisory · Maven

GHSA-c8cw-2c5j-xff3 Incorrect Authorization in Apache Ozone

MEDIUM Published 2021-11-23 Modified 2021-11-22 Official page ↗
Aliases
CVE-2021-39234
Ecosystem
Maven
Packages
org.apache.ozone:ozone-main
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-863
Reviewed
2021-11-22

Affected packages

• Maven org.apache.ozone:ozone-main: < 1.2.0 → fixed in 1.2.0

Description

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.

Related

Alias · CVE (1)

  • CVE-2021-39234 In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References