CVE-2021-36372

CVE-2021-36372: Original block tokens are persisted and can be retrieved

Vendor Apache Software Foundation

Product Apache Ozone

Weakness CWE-273

Published November 19, 2021

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

Key dates

02Disclosure timeline

November 19, 2021 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-36372 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/273.html

Related vulnerabilities

04Related CVE

CVE-2023-5369 copy_file_range insufficient capability rights check CVE-2025-62175 Mastodon streaming API fails to disconnect disabled and suspended users CVE-2026-21882 theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution CVE-2025-1003 HP Anyware Agent for Linux – Potential Authentication Bypass CVE-2021-3982