CVE-2021-39231

CVE-2021-39231: Missing authentication/authorization on internal RPC endpoints

Vendor Apache Software Foundation

Product Apache Ozone

Weakness CWE-862 · Missing authorization

Published November 19, 2021

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

Key dates

02Disclosure timeline

November 19, 2021 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-39231 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2023-48676 CVE-2026-27686 Missing Authorization check in SAP Business Warehouse (Service API) CVE-2026-9015 Equalize Digital Accessibility Checker <= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action CVE-2026-3432 Sim Studio AI - Unauthenticated OAuth Token Theft CVE-2024-30459 WordPress AI WP Writer plugin <= 3.6.5 - Broken Access Control vulnerability