CVE-2021-39236 json
Owners of the S3 tokens are not validated
published 2021-11-19 4 y ago modified 2026-06-17 4 mo ago also GHSA-5993-wwpg-m92c , EUVD-2021-2299
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
Patch / fix
- maven org.apache.hadoop:hadoop-ozone-ozone-manager 1.2.0
- apache ozone 1.2.0
- github.com/apache/ozone@60e0787 commit
- github.com/apache/ozone#1871 pull request
Exploit prediction
2.64% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- issues.apache.org https://issues.apache.org/jira/browse/HDDS-4763 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.hadoop:hadoop-ozone-ozone-manager | <1.2.0 |
1.2.0 |
Affected products
- Apache Software Foundation Apache Ozone
Classification
References
-
github.com
/apache/ozone/pull/1871
web
-
github.com
/apache/ozone/commit/60e078729e18ef1be276f35659957ac553d266f7
web
-
issues.apache.org
/jira/browse/HDDS-4763
issue-tracking, web, exploit
-
mail-archives.apache.org
/mod_mbox/ozone-dev/202111.mbox/%3C0fd74baa-88a0-39a2-8f3a-b982acb25d5a%40apache.org%3E
web, mailing-list, mitigation, vendor-advisory
-
openwall.com
/lists/oss-security/2021/11/19/7
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-39236
advisory
-
github.com
/apache/ozone
package
-
lists.apache.org
/thread/q0lhspolnwfbsw33w98b7b1923n1np4d
web
Sources
- CVE List CVE-2021-39236
- GitHub Advisory GHSA-5993-wwpg-m92c
- NVD CVE-2021-39236
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.