PT-2025-29290 · Apache · Apache Sentry

Published 2025-07-12 · Updated 2025-07-14 · CVE-2023-39338

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Sentry (affected versions not specified)

Description: An authenticated user (enrolled device) may access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. This does not enable the user to authenticate to or use the service, but provides tunnel access.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-39338

Affected Products

Apache Sentry

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-39338 · Security Note
• https://t.me/cvenotify/128675 · Telegram Post
• https://t.me/cvetracker/27615 · Telegram Post
• https://t.me/cvenotify/128855 · Telegram Post
• https://forums.ivanti.com/s/article/CVE-2023-39338 · Note
• https://twitter.com/CVEnew/status/1943883747566182679 · Twitter Post