Vulnerability in Apache Accumulo
CVE-2020-17533
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.037 (89.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.037 · newest: 0.037 · change: +0.000
Affected products
- Apache Accumulo — versions 2.0.0
- Apache Software Foundation Accumulo — versions Apache Accumulo 2.0.0, 1.5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8… (Mailing List)
- lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8… (Vendor Advisory, mailing-list)
- www.openwall.com/lists/oss-security/2020/12/29/1 (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-17533?
- CVE-2020-17533 is a high-severity vulnerability in Apache Accumulo, classified under CWE-252. CVSS score: 8.1/10. Published 2020-12-29.
- How severe is CVE-2020-17533?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2020-17533 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.