CVE-2021-39231

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

• CWE-862
• CWE-862

• http://www.openwall.com/lists/oss-security/2021/11/19/2Mailing List, Third Party Advisory
• https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C110cd117-75ed-364b-cd38-3effd20f2183%40apache.org%3EMailing List, Mitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2021/11/19/2Mailing List, Third Party Advisory
• https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C110cd117-75ed-364b-cd38-3effd20f2183%40apache.org%3EMailing List, Mitigation, Vendor Advisory

Published

Nov 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39226Grafana is an open source data visualization platform. In af…7.3
• CVE-2021-39227ZRender is a lightweight graphic library providing 2d draw f…9.8
• CVE-2021-39228Tremor is an event processing system for unstructured data. …9.8
• CVE-2021-39229Apprise is an open source library which allows you to send a…7.5
• CVE-2021-3923A flaw was found in the Linux kernel's implementation of RDM…2.3
• CVE-2021-39230Butter is a system usability utility. Due to a kernel error …6.5
• CVE-2021-39232In Apache Ozone versions prior to 1.2.0, certain admin relat…8.8
• CVE-2021-39233In Apache Ozone versions prior to 1.2.0, Container related D…9.1
• CVE-2021-39234In Apache Ozone versions prior to 1.2.0, Authenticated users…6.8
• CVE-2021-39235In Apache Ozone before 1.2.0, Ozone Datanode doesn't check t…6.5
• CVE-2021-39236In Apache Ozone before 1.2.0, Authenticated users with valid…8.8
• CVE-2021-39237Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and H…4.6