Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-39196 Details

Description

Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability. The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone. This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://lists.apache.org/thread/o96ct5t7kj5cgrmmfc6756m931t08nky CVEIssue TrackingVendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/07/2 CVEMailing ListThird Party Advisory
https://lists.apache.org/thread/o96ct5t7kj5cgrmmfc6756m931t08nky [email protected]Issue TrackingVendor Advisory
http://www.openwall.com/lists/oss-security/2024/02/07/2 [email protected]Mailing ListThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-287Improper Authentication[email protected]

Affected Products

ProductVersions
apache ozone
>= 1.2.0, <= 1.3.0

CPE

  • cpe:2.3:a:apache:ozone:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

8 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-39196
NVD Published Date:
Feb 7, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]