CVE-2021-39234CWE-20

Raw block data can be read bypassing ACL/authorization

published November 19, 2021

CVSS
—
EPSS
1%
Percentile
72.5
In the wild
Unconfirmed
What it is

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01412 · 72.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2021-11-19T09:20Z
EPSS history
Timeline
  • 19 NOV 09:20Z
    Raw block data can be read bypassing ACL/authorization
    cvelistv5