CVE-2021-39234

Опубликовано: 19 нояб. 2021

Источник: nvd

CVSS3: 6.8

CVSS2: 4.9

EPSS Низкий

Описание

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.

Ссылки

http://www.openwall.com/lists/oss-security/2021/11/19/5
Third Party Advisory
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C97d65498-7f8c-366f-1bea-5a74b6378f0d%40apache.org%3E
Mailing List
Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/11/19/5
Third Party Advisory
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C97d65498-7f8c-366f-1bea-5a74b6378f0d%40apache.org%3E
Mailing List
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:ozone:*:*:*:*:*:*:*:*

Версия до 1.2.0 (исключая)

EPSS

Процентиль: 42%

0.00199

Низкий

6.8 Medium

CVSS3

4.9 Medium

CVSS2

Дефекты

CWE-20

CWE-863

Связанные уязвимости

GHSA-c8cw-2c5j-xff3