CVE-2024-45106: apache ozone

csirt@kutim:~/threat-intel/cve/CVE-2024-45106

CVSS 8.1 · High EPSS 0,58%

Kerentanan Improper Authentication pada apache ozone. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false. * The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators. Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint.

Rincian

Terbit di NVD: 3 Desember 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-287: Improper Authentication
CWE-863: Incorrect Authorization
EPSS (30 hari): 0,58% peluang dieksploitasi; lebih tinggi dari 46,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	ozone	Versi 1.4.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/rylnxwttp004kvotpk9j158vb238pfkm mailing list · advisory vendor
http://www.openwall.com/lists/oss-security/2024/12/02/1 mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.