CVE-2021-39231
Assigner: apache
Published: 2021-11-19T09:20:17
State: PUBLISHED
affected: product: Apache Ozone
vendor: Apache Software Foundation
versions: lessThanOrEqual: 1.0
status: affected
version: 1.0
versionType: custom
credits: value: Apache Ozone would like to thank Marton Elek for reporting this issue.
descriptions: value: In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.
problemTypes: descriptions: cweId: CWE-862
description: CWE-862 Missing Authorization
type: CWE
source: defect: HDDS-4704
HDDS-4730
HDDS-4496
HDDS-4788
discovery: UNKNOWN
title: Missing authentication/authorization on internal RPC endpoints
workarounds: value: Upgrade to Apache Ozone release version 1.2.0
x_generator: engine: Vulnogram 0.0.9