Skip to content
OpenAdvisories
High · 8.8 CVE-2021-39232 EUVD-2021-2341GHSA-ff84-84q5-fq4f

Missing admin check for SCM related admin commands

Published Nov 19, 2021 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Ozone Package: org.apache.ozone:ozone-main Ecosystem: Maven

Description

In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Ozone 1.0 – ≤ 1.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.ozone:ozone-main < 1.2.0 1.2.0 GHSA-ff84-84q5-fq4f

References