CVE-2021-41532

Apache Ozone prior to 1.2.0 has an access-control flaw: Recon HTTP endpoints expose OM, SCM and Datanode metadata to unauthenticated users due to a bug. Affected component is Recon HTTP endpoints in Ozone; root cause is insufficient access controls allowing data exposure. Impact is exposure of me...

CVE-2023-39196

CVE-2023-39196 describes an improper authentication vulnerability in Apache Ozone (affecting 1.2.0 up to 1.3.0). The issue allows an attacker to download internal metadata from the Storage Container Manager service without authenticating, but does not permit modification or access to actual user ...