Vulnerability in Apache Ozone
CVE-2021-39235
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
EPSS: 0.015 (71.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Apache Ozone
- Apache Software Foundation Ozone — versions 1.0
Weakness classification (CWE)
References
- security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-39235?
- CVE-2021-39235 is a medium-severity vulnerability in Apache Ozone, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.5/10. Published 2021-11-19.
- How severe is CVE-2021-39235?
- Medium severity. CVSS v3 base score is 6.5 out of 10.