In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HApache Ozone
APPApache< 1.2.0
π΅
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
References
Related vulnerabilities
CVE-2021-36372CRITICAL9.8ten sam produkt
In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata databa...
CVE-2021-39231CRITICAL9.1ten sam produkt
In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for con...
CVE-2021-39233CRITICAL9.1ten sam produkt
In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not proper...
CVE-2024-45106HIGH8.1ten sam produkt
Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated K...
CVE-2021-39232HIGH8.8ten sam produkt
In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticat...