Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2020-17533 EUVD-2022-1022GHSA-grc3-8q8m-4j7c

Apache Accumulo Improper Handling of Insufficient Permissions

Published Dec 29, 2020 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Accumulo Package: org.apache.accumulo:accumulo-master Ecosystem: Maven

Description

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Accumulo Apache Accumulo 2.0.0, 1.5.0 – < Apache Accumulo* Apache Accumulo*

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.accumulo:accumulo-master >= 1.5.0, < 1.10.1 1.10.1 GHSA-grc3-8q8m-4j7c
Maven org.apache.accumulo:accumulo-master >= 2.0.0, < 2.0.1 2.0.1 GHSA-grc3-8q8m-4j7c

References