CVE-2021-40865

🗓️ 25 Oct 2021 12:22:37Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 112 Views🌐 WEB

Unsafe Deserialization vulnerability in Apache Storm allows pre-auth RC

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: Due to use of Apache Storm IBM Tivoli Network Manager is vulnerable to arbiraty code execution ( CVE-2021-38294, CVE-2021-40865 )	14 Apr 202214:33	–	ibm
GithubExploit	Exploit for Deserialization of Untrusted Data in Apache Storm	26 Nov 202110:09	–	githubexploit
ATTACKERKB	CVE-2021-40865	25 Oct 202113:15	–	attackerkb
Tenable Nessus	Apache Storm 1.x < 1.2.4 / 2.1.x < 2.1.1 / 2.2.x < 2.2.1 Multiple Vulnerabilities	26 Sep 202300:00	–	nessus
BDU FSTEC	The vulnerability of the software platform services for distributed stream computing, Apache Storm, allows a hacker to execute arbitrary code on the target system.	24 Dec 202100:00	–	bdu_fstec
Circl	CVE-2021-40865	26 Nov 202110:14	–	circl
CNNVD	Apache Storm 代码问题漏洞	25 Oct 202100:00	–	cnnvd
CNVD	Apache Storm code issue vulnerability	26 Oct 202100:00	–	cnvd
Check Point Advisories	Apache Storm Remote Code Execution (CVE-2021-40865)	28 Feb 202200:00	–	checkpoint_advisories
Cvelist	CVE-2021-40865 Unsafe Pre-Authentication Deserialization In Workers	25 Oct 202112:22	–	cvelist

NVD

Vulners

Node

apache stormRange1.0.0–1.2.4

apache stormRange2.1.0–2.1.1

apache stormRange2.2.0–2.2.1

[
  {
    "product": "Apache Storm",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "Apache Storm *",
        "status": "affected",
        "version": "v1.0.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "v2.1.1",
            "status": "unaffected"
          },
          {
            "at": "v2.2.1",
            "status": "unaffected"
          },
          {
            "at": "v2.3.0",
            "status": "unaffected"
          }
        ],
        "lessThan": "v1.2.4",
        "status": "affected",
        "version": "Apache Storm",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
seclists	www.seclists.org/oss-sec/2021/q4/45
lists	www.lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E

Parameter	Position	Path	Description	CWE
command	nested	k6r17p7xvz8a7wj638bqj6dydpji77.burpcollaborator.net	POC uses URLDNS gadget for remote code execution via unsafe deserialization in Apache Storm; the command contains a callback URL used by the payload.	CWE-502

17 Jun 2026 04:07Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.65587

CWE-502