PT-2020-15036 · Apache · Apache Accumulo

Billie Rinaldi · Published 2020-12-29 · Updated 2024-01-31 · CVE-2020-17533

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Accumulo versions 1.5.0 through 1.10.0 Apache Accumulo version 2.0.0

Description The issue arises from improper checking of return values of certain policy enforcement functions, specifically the canFlush and canPerformSystemActions security functions. This allows an authenticated user with insufficient permissions to perform administrative operations such as flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.

Recommendations For Apache Accumulo versions 1.5.0 through 1.10.0, consider restricting access to administrative operations until a proper fix is applied. For Apache Accumulo version 2.0.0, consider temporarily disabling the canFlush and canPerformSystemActions security functions to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Unchecked Return Value

Weakness Enumeration

CWE-280

CWE-732

CWE-252

Related Identifiers

CVE-2020-17533

GHSA-GRC3-8Q8M-4J7C

Affected Products

Apache Accumulo

References · 14

• https://osv.dev/vulnerability/CVE-2020-17533 · Vendor Advisory
• https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cannounce.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17533 · Security Note
• https://osv.dev/vulnerability/GHSA-grc3-8q8m-4j7c · Vendor Advisory
• https://github.com/apache/accumulo/commit/56142a89952533fef922fa86739a879c073e7c2a · Note
• https://github.com/apache/accumulo/commit/877ad502f6857e48342664e4b0ce83db74e4cda4 · Note
• https://github.com/apache/accumulo · Note
• http://openwall.com/lists/oss-security/2020/12/29/1 · Note
• https://t.me/cvenotify/68138 · Telegram Post
• https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed@%3Cannounce.apache.org%3E · Note
• https://lists.apache.org/thread.html/rf8c1a787b6951d3dacb9ec58f0bf1633790c91f54ff10c6f8ff9d8ed%40%3Cuser.accumulo.apache.org%3E · Note
• https://t.me/cvenotify/69302 · Telegram Post
• https://t.me/cvenotify/7875 · Telegram Post
• https://t.me/cvenotify/7862 · Telegram Post