title: Unauthenticated access to Ozone Recon HTTP endpoints
description: In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
product: Apache Ozone
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 1.1.0, status: affected, version: Everglades (1.1.0), versionType: custom
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]
workarounds: Upgrade to Apache Ozone release version 1.2.0