Auth bypass in Apache Ozone
CVE-2023-39196
Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability. The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone. This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.008 (55.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Apache Ozone
- Apache Software Foundation Ozone — versions 1.2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread/o96ct5t7kj5cgrmmfc6756m931t08nky (vendor-advisory, Issue Tracking, Vendor Advisory)
- www.openwall.com/lists/oss-security/2024/02/07/2 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-39196?
- CVE-2023-39196 is a medium-severity vulnerability in Apache Ozone, classified under Improper Authentication. CVSS score: 5.3/10. Published 2024-02-07.
- How severe is CVE-2023-39196?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-39196 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.