HIGH🇬🇧 English

CVE-2021-39236

CVSS 8.8v3.1pub. 2021-11-19upd. 2024-11-21

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Apache Ozone

    APP
    Apache
    < 1.2.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2021-36372CRITICAL9.8ten sam produkt

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata databa...

CVE-2021-39231CRITICAL9.1ten sam produkt

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for con...

CVE-2021-39233CRITICAL9.1ten sam produkt

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not proper...

CVE-2024-45106HIGH8.1ten sam produkt

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated K...

CVE-2021-39232HIGH8.8ten sam produkt

In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticat...