CVE-2020-17517
Ozone S3 Gateway allows bucket and key access to non authenticated users
- State
- Published
- Severity
- Not scored
- Published
- Apr 27, 2021
- Updated
- Aug 4, 2024
- Reserved
- Aug 12, 2020
Description
The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereby exposing data to anonymous clients or users. This affected Apache Ozone prior to the 1.1.0 release.
Scores
The record has no CVSS score.
Weaknesses
- CWE-285 Improper Authorization
Affected Products
| Product | Versions |
|---|---|
Apache OzoneApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.