Vulnerability in Apache Accumulo
CVE-2020-17533
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.
EPSS: 0.037 (88.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Apache Accumulo — versions 2.0.0
- Apache Software Foundation Accumulo — versions Apache Accumulo 2.0.0, 1.5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (Mailing List, x_refsource_MISC)
- security@apache.org (Vendor Advisory, mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-17533?
- CVE-2020-17533 is a high-severity vulnerability in Apache Accumulo, classified under CWE-252. CVSS score: 8.1/10. Published 2020-12-29.
- How severe is CVE-2020-17533?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2020-17533 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.