CVE-2020-17533

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.

• CWE-252
• CWE-252

• http://www.openwall.com/lists/oss-security/2020/12/29/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cannounce.apache.org%3EVendor Advisory
• https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cuser.accumulo.apache.org%3EMailing List
• http://www.openwall.com/lists/oss-security/2020/12/29/1Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cannounce.apache.org%3EVendor Advisory
• https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cuser.accumulo.apache.org%3EMailing List

Published

Dec 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17528Out-of-bounds Write vulnerability in TCP stack of Apache Nut…9.1
• CVE-2020-17529Out-of-bounds Write vulnerability in TCP Stack of Apache Nut…9.8
• CVE-2020-1753A security flaw was found in Ansible Engine, all Ansible 2.7…5.5
• CVE-2020-17530Forced OGNL evaluation, when evaluated on raw user input in …9.8
• CVE-2020-17531A Java Serialization vulnerability was found in Apache Tapes…9.8
• CVE-2020-17532When handler-router component is enabled in servicecomb-java…8.8
• CVE-2020-17534There exists a race condition between the deletion of the te…7
• CVE-2020-17535Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17536Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17537Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17538A buffer overflow vulnerability in GetNumSameData() in contr…5.5
• CVE-2020-1754In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewi…4.3