Unrated severityNVD Advisory· Published Apr 27, 2021· Updated Aug 4, 2024
Ozone S3 Gateway allows bucket and key access to non authenticated users
CVE-2020-17517
Description
The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereby exposing data to anonymous clients or users. This affected Apache Ozone prior to the 1.1.0 release.
Affected products
2- Apache Software Foundation/Apache Ozonev5Range: Apache Ozone
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.