Lucene search
Veracode Vulnerability DatabaseVERACODE:33055HistoryNov 22, 2021 - 4:51 p.m.
User Impersonation
2021-11-2216:51:25
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
5
0.003 Low
EPSS
Percentile
68.2%
hadoop-ozone-common is vulnerable to user impersonation. The vulnerability exists due to an insecure validation of owner field of S3AUTHINFO type delegation token, allowing authenticated users with valid Ozone S3 credentials to create specific OM requests and impersonate other user.
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache ozone common | le | 1.1.0 | |
| apache ozone common | le | 0.5.0-beta | |
| apache ozone common | le | 1.1.0 | |
| apache ozone common | le | 0.5.0-beta |
Related
osv
osv
Apache Ozone user impersonation due to non-validation of Ozone S3 tokens
2021-11-23 17:56:45
CVE-2021-39236
2021-11-19 10:15:08
cvelist
cvelist
CVE-2021-39236 Owners of the S3 tokens are not validated
2021-11-19 09:20:25
cnvd
cnvd
Apache Ozone Licensing Issue Vulnerability (CNVD-2021-91629)
2021-11-24 00:00:00
cve
cve
CVE-2021-39236
2021-11-19 10:15:08
prion
prion
Code injection
2021-11-19 10:15:00
nvd
nvd
CVE-2021-39236
2021-11-19 10:15:08
github
github
Apache Ozone user impersonation due to non-validation of Ozone S3 tokens
2021-11-23 17:56:45