Vulnerability · Published Apr 27, 2021 · Assigned by apache
CVE-2020-17517Ozone S3 Gateway allows bucket and key access to non authenticated users
High 7.5
In plain English
A high-severity security flaw in Apache Ozone from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.3%top 16.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereby exposing data to anonymous clients or users. This affected Apache Ozone prior to the 1.1.0 release.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Ozone | Apache Ozone – through 1.0.0 |
Weakness: CWE-285