The vulnerability of the software platform services for distributed stream computing, Apache Storm, allows a hacker to execute arbitrary code on the target system.

Apache Storm deserialization flaw allows remote arbitrary code execution on a target system.

Reporter	Title	Published	Views	Family All 16
IBM Security Bulletins	Security Bulletin: Due to use of Apache Storm IBM Tivoli Network Manager is vulnerable to arbiraty code execution ( CVE-2021-38294, CVE-2021-40865 )	14 Apr 202214:33	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Storm	26 Nov 202110:09	–	githubexploit
Tenable Nessus	Apache Storm 1.x < 1.2.4 / 2.1.x < 2.1.1 / 2.2.x < 2.2.1 Multiple Vulnerabilities	26 Sep 202300:00	–	nessus
Circl	CVE-2021-40865	26 Nov 202110:14	–	circl
CNNVD	Apache Storm 代码问题漏洞	25 Oct 202100:00	–	cnnvd
CNVD	Apache Storm code issue vulnerability	26 Oct 202100:00	–	cnvd
Check Point Advisories	Apache Storm Remote Code Execution (CVE-2021-40865)	28 Feb 202200:00	–	checkpoint_advisories
CVE	CVE-2021-40865	25 Oct 202112:22	–	cve
Cvelist	CVE-2021-40865 Unsafe Pre-Authentication Deserialization In Workers	25 Oct 202112:22	–	cvelist
F5 Networks	K44104514: Apache Storm vulnerability CVE-2021-40865	21 Feb 202320:00	–	f5

Vulners

Node

apache stormRange2.2.0–2.2.1

apache stormRange2.1.0–2.1.1

apache stormRange1.0.0–1.2.4

Source	Link
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2021112001
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-40865
lists	www.lists.apache.org/thread/wt9f7lsz6xhyxotf0g099w3xbs9f1b1x
web	www.web.nvd.nist.gov/view/vuln/detail

24 Dec 2021 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 39.8

CVSS 210

EPSS0.4622