QwikSec

Security Database

CVE

CWE

Training

CVE-2021-39231

Published: Nov 19, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

Vendor	Product	Versions
Apache Software Foundation	Apache Ozone	affected `1.0 - <= 1.0`

Weaknesses (CWE)

References

https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C110cd117-75ed-364b-cd38-3effd20f2183%40apache.org%3E

x_refsource_MISC

[oss-security] 20211118 CVE-2021-39231: Apache Ozone: Missing authentication/authorization on internal RPC endpoints

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.