Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2021-39233

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.

VectorNETWORK

PublishedNov 19, 2021, 10:15

Published Bysecurity@apache.org

Base Score

Score9.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.ozone:ozone-main(Maven)01.2.0N/A

References

http://www.openwall.com/lists/oss-security/2021/11/19/4
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E

Weakness Type

NVD-CWE-Other

CVSS Metrics

Base Score

9.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK