CVE-2020-17517

The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereby exposing data to anonymous clients or users. This affected Apache Ozone prior to the 1.1.0 release.

• CWE-285
• CWE-306

• https://lists.apache.org/thread.html/rdd59a176b32c63f7fc0865428bf9bbc69297fa17f6130c80c25869aa%40%3Cdev.ozone.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/rdd59a176b32c63f7fc0865428bf9bbc69297fa17f6130c80c25869aa%40%3Cdev.ozone.apache.org%3EMailing List, Vendor Advisory

Published

Apr 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17510Apache Shiro before 1.7.0, when using Apache Shiro with Spri…9.8
• CVE-2020-17511In Airflow versions prior to 1.10.13, when creating a user u…6.5
• CVE-2020-17513In Apache Airflow versions prior to 1.10.13, the Charts and …5.3
• CVE-2020-17514Apache Fineract prior to 1.5.0 disables HTTPS hostname verif…7.4
• CVE-2020-17515The "origin" parameter passed to some of the endpoints like …6.1
• CVE-2020-17516Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, …7.5
• CVE-2020-17518Apache Flink 1.5.1 introduced a REST handler that allows you…7.5
• CVE-2020-17519A change introduced in Apache Flink 1.11.0 (and released in …7.5
• CVE-2020-1752A use-after-free vulnerability introduced in glibc upstream …7
• CVE-2020-17520In the Pulsar manager 0.1.0 version, malicious users will be…6.5
• CVE-2020-17521Apache Groovy provides extension methods to aid with creatin…5.5
• CVE-2020-17522When ORT (now via atstccfg) generates ip_allow.config files …5.8