Lucene search

[email protected]CVE-2017-9799

HistoryAug 09, 2017 - 9:29 p.m.

CVE-2017-9799

2017-08-0921:29:01

[email protected]

web.nvd.nist.gov

cve-2017-9799

apache storm

security

vulnerability

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

73.3%

JSON

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.

Affected configurations

Vulners

NVD

Node

apachestormRange≤1.1.0

CPENameOperatorVersion
apache:stormapache stormeq1.0
apache:stormapache stormeq1.0.1
apache:stormapache stormeq1.0.2
apache:stormapache stormeq1.0.3
apache:stormapache stormeq1.1

CPE	Name	Operator	Version
apache:storm	apache storm	eq	1.0
apache:storm	apache storm	eq	1.0.1
apache:storm	apache storm	eq	1.0.2
apache:storm	apache storm	eq	1.0.3
apache:storm	apache storm	eq	1.1

CNA Affected

[
  {
    "product": "Apache Storm",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0 through 1.0.3"
      },
      {
        "status": "affected",
        "version": "1.1.0"
      }
    ]
  }
]