CVE-2021-36372

Published: Nov 19, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

Affected (1)

Products: Apache: Ozone

Apache

1 product

Ozone

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Ozone	Before 1.2.0

Related CWEs

CWE-273

Improper Check for Dropped Privileges

The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

References (4)

http://www.openwall.com/lists/oss-security/2021/11/19/1

Source: security@apache.org

Third Party Advisory

https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3E

Source: security@apache.org

Mailing ListMitigationVendor Advisory

http://www.openwall.com/lists/oss-security/2021/11/19/1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListMitigationVendor Advisory

Timeline

No history available yet.