In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
[
{
"product": "Apache Ozone",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "1.1.0",
"status": "affected",
"version": "Everglades (1.1.0)",
"versionType": "custom"
}
]
}
]