VULNERABILITY INTELLIGENCE

CVE-2021-39234

CVSS score6.8 MEDIUM

EPSS probability1.41%

CISA KEVNot currently listed

Published2021-11-19

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.

Weakness classification

security@apache.org: CWE-20
nvd@nist.gov: CWE-863

Primary references

security@apache.org — Third Party Advisory
security@apache.org — Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Vendor Advisory