Vulnerability Details CVE-2021-39235
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 65.0%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.0
References
- http://www.openwall.com/lists/oss-security/2021/11/19/6
- https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/11/19/6
- https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E
Products affected by CVE-2021-39235
-
cpe:2.3:a:apache:ozone:-
-
cpe:2.3:a:apache:ozone:0.4.2
-
cpe:2.3:a:apache:ozone:0.5.0
-
cpe:2.3:a:apache:ozone:1.0.0
-
cpe:2.3:a:apache:ozone:1.1.0