CVE-2020-17533
Apache Accumulo Improper Handling of Insufficient Permissions
- State
- Published
- Severity
- Not scored
- Published
- Dec 29, 2020
- Updated
- Aug 4, 2024
- Reserved
- Aug 12, 2020
Description
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.
Scores
The record has no CVSS score.
Weaknesses
- CWE-252 Improper Handling of Insufficient Permissions or Privileges
Affected Products
| Product | Versions |
|---|---|
Apache AccumuloApache Software Foundation |
|
References
- https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cuser.accumulo.apache.org%3E
- [announce] 20201228 [SECURITY] CVE-2020-17533: Apache Accumulo Improper Handling of Insufficient Permissionsmailing-list
- [oss-security] 20201228 CVE-2020-17533: Apache Accumulo Improper Handling of Insufficient Permissionsmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.