CVE-2021-39235

—

CVSS 3.1

6.5 medium

EPSS

2%p73

Published

Nov 19, 2021 (Nov 19, 2021)

Modified

Jun 17, 2026

Description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

Vendors: apache
Products: ozone
Weakness: CWE-732
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.