High severity vulnerability that affects org.apache.storm:storm-core

2018-10-1719:48:06

Google

osv.dev

0.01 Low

EPSS

Percentile

83.9%

JSON

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.

CPENameOperatorVersion
org.apache.storm:storm-coreeq1.1.1
org.apache.storm:storm-coreeq1.2.0
org.apache.storm:storm-coreeq1.0.3
org.apache.storm:storm-coreeq1.1.0
org.apache.storm:storm-coreeq0.10.0
org.apache.storm:storm-coreeq0.10.2
org.apache.storm:storm-coreeq1.2.1
org.apache.storm:storm-coreeq1.1.2
org.apache.storm:storm-coreeq0.9.1-incubating
org.apache.storm:storm-coreeq0.9.6

Name	Operator	Version
org.apache.storm:storm-core	eq	1.1.1
org.apache.storm:storm-core	eq	1.2.0
org.apache.storm:storm-core	eq	1.0.3
org.apache.storm:storm-core	eq	1.1.0
org.apache.storm:storm-core	eq	0.10.0
org.apache.storm:storm-core	eq	0.10.2
org.apache.storm:storm-core	eq	1.2.1
org.apache.storm:storm-core	eq	1.1.2
org.apache.storm:storm-core	eq	0.9.1-incubating
org.apache.storm:storm-core	eq	0.9.6