CVE-2023-39196

Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability. The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone. This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

• CWE-287

• http://www.openwall.com/lists/oss-security/2024/02/07/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/o96ct5t7kj5cgrmmfc6756m931t08nkyIssue Tracking, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/02/07/2Mailing List, Third Party Advisory
• https://lists.apache.org/thread/o96ct5t7kj5cgrmmfc6756m931t08nkyIssue Tracking, Vendor Advisory

Published

Feb 7, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-39190Rejected reason: CVE-2023-39190 was found to be a duplicate …
• CVE-2023-39191An improper input validation flaw was found in the eBPF subs…8.2
• CVE-2023-39192A flaw was found in the Netfilter subsystem in the Linux ker…6
• CVE-2023-39193A flaw was found in the Netfilter subsystem in the Linux ker…6
• CVE-2023-39194A flaw was found in the XFRM subsystem in the Linux kernel. …4.4
• CVE-2023-39195Rejected reason: CVE-2023-39195 was found to be a duplicate …
• CVE-2023-39197An out-of-bounds read vulnerability was found in Netfilter C…7.5
• CVE-2023-39198A race condition was found in the QXL driver in the Linux ke…6.4
• CVE-2023-39199Cryptographic issues with In-Meeting Chat for some Zoom clie…6.5
• CVE-2023-3920An issue has been discovered in GitLab affecting all version…4.3
• CVE-2023-39201Untrusted search path in CleanZoom before file date 07/24/20…6.7
• CVE-2023-39202Untrusted search path in Zoom Rooms Client for Windows and Z…5.5