GHSA-5993-wwpg-m92cHighCVSS 8.8

Apache Ozone user impersonation due to non-validation of Ozone S3 tokens

Published
November 23, 2021
Last Modified
December 5, 2023

🔗 CVE IDs covered (1)

CVE-2021-39236 →

📋 Description

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.

🎯 Affected products1

  • maven/org.apache.hadoop:hadoop-ozone-ozone-manager:< 1.2.0

🔗 References (8)