Vulnerability Details : CVE-2023-39196
Improper Authentication vulnerability in Apache Ozone.
The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication.
The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability.
The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone.
This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Vulnerability category: BypassGain privilege
Products affected by CVE-2023-39196
- cpe:2.3:a:apache:ozone:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-39196
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-39196
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST | 2024-02-16 |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
Apache Software Foundation | 2024-02-07 |
CWE ids for CVE-2023-39196
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: security@apache.org (Primary)
References for CVE-2023-39196
-
https://lists.apache.org/thread/o96ct5t7kj5cgrmmfc6756m931t08nky
CVE-2023-39196: Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints-Apache Mail ArchivesIssue Tracking;Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2024/02/07/2
oss-security - CVE-2023-39196: Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpointsMailing List;Third Party Advisory
Jump to