-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.ozone:ozone | maven | = 1.4.0 | 1.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the S3SecretManagementEndpoint class added in PR #5233, which introduced REST endpoints for S3 secret management. The functions handle() sensitive operations but lacked proper authorization validation(). The CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization) mappings confirm the authentication/authorization flaws. The patch in 1.4.1 disables the endpoint entirely, indicating these functions were the vulnerability source. The HTTP method annotations (@PUT/@DELETE) and path parameters shown in code diffs align with the described attack vector.
A Semantic Attack on Google Gemini - Read the Latest Research