GHSA-grc3-8q8m-4j7c

Source

https://github.com/advisories/GHSA-grc3-8q8m-4j7c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-grc3-8q8m-4j7c/GHSA-grc3-8q8m-4j7c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-grc3-8q8m-4j7c

Aliases

CVE-2020-17533

Published

2022-02-09T22:37:59Z

Modified

2024-02-16T08:05:55.194537Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

Improper privilege handling in Apache Accumulo

Details

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.

Database specific

{
    "nvd_published_at": "2020-12-29T12:15:00Z",
    "cwe_ids": [
        "CWE-252",
        "CWE-280",
        "CWE-732"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-07T22:41:39Z"
}

References

Affected packages

Maven / org.apache.accumulo:accumulo-master

Package

Name: org.apache.accumulo:accumulo-master; View open source insights on deps.dev
Purl: pkg:maven/org.apache.accumulo/accumulo-master

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.5.0

Fixed

1.10.1

Affected versions

1.*

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.8.0

1.8.1

1.9.0

1.9.1

1.9.2

1.9.3

1.10.0

Maven / org.apache.accumulo:accumulo-master

Package

Name: org.apache.accumulo:accumulo-master; View open source insights on deps.dev
Purl: pkg:maven/org.apache.accumulo/accumulo-master

GHSA-grc3-8q8m-4j7c

Affected packages

Maven / org.apache.accumulo:accumulo-master

Package

Affected ranges

Affected versions

1.*

Maven / org.apache.accumulo:accumulo-master

Package

Affected ranges

Affected versions

2.*