Vulnerability Details CVE-2021-39233
In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.018
EPSS Ranking 82.1%
CVSS Severity
CVSS v3 Score 9.1
CVSS v2 Score 6.4
References
- http://www.openwall.com/lists/oss-security/2021/11/19/4
- https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/11/19/4
- https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E
Products affected by CVE-2021-39233
-
cpe:2.3:a:apache:ozone:-
-
cpe:2.3:a:apache:ozone:0.4.2
-
cpe:2.3:a:apache:ozone:0.5.0
-
cpe:2.3:a:apache:ozone:1.0.0
-
cpe:2.3:a:apache:ozone:1.1.0