Skip to content

Product

org.apache.ozone/ozone vulnerabilities

1 published CVE affecting org.apache.ozone/ozone, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
1
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest org.apache.ozone/ozone CVEs

Newest publication first

  1. CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets

    Published
    HighCVSS 8.1 EPSS 0.58%

    Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: ozone.s3g.secret.http.enabled is set to true. The default value of this...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.