VULNERABILITY INTELLIGENCE

CVE-2021-36372

CVSS score9.8 CRITICAL

EPSS probability2.53%

CISA KEVNot currently listed

Published2021-11-19

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

Weakness classification

security@apache.org: CWE-273
nvd@nist.gov: CWE-273

Primary references

security@apache.org — Third Party Advisory
security@apache.org — Mailing List, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Mitigation, Vendor Advisory