Unauthorized File Access

Apache Storm Core is vulnerable to unauthorized file read. It exposes HTTP-accessible endpoints on the host's file system, allowing an attacker to read/search log files on the host...

CVE-2019-0202

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

CVE-2019-0202

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

CVE-2018-11779

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

CVE-2018-11779

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

Code injection

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

Security feature bypass

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

Apache Storm Information Disclosure Vulnerability

Apache Storm is the United States Apache Apache Software Foundation, a set of open source distributed real-time computing system using Clojure concurrent programming language development. An information disclosure vulnerability exists in Apache Storm versions 0.9.1-incubating through 1.2.2. The...

CVE-2018-11779

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

CVE-2018-11779

Technical details about CVE-2018-11779 are not provided in the supplied documents. Monitor for updates from official advisories.

Apache Storm Deserialization Vulnerability

Apache Storm is the United States Apache Apache Software Foundation, a set of open source distributed real-time computing system using Clojure concurrent programming language development. A deserialization vulnerability exists in Apache Storm versions 1.1.0 through 1.2.2. The vulnerability stems...

Apache Storm WebUI Detection

Binary data apachestormwebuidetect.nbin...

Apache Storm Version Detection

Binary data apachestormdetect.nbin...

Apache Storm < 1.1.3 / 1.2.x < 1.2.2 arbitrary file write vulnerability

The version of Apache Storm running on the remote host is prior to 1.1.3 or 1.2.x prior to 1.2.2. It is, therefore, affected by an arbitrary file write vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid122487; scriptversion"1.3"; scriptcvsdate"Date:...

Moderate severity vulnerability that affects org.apache.storm:storm-core

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons...

Code execution in org.apache.storm:storm-core

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user...

com.accelerate-experience:storm-metrics-statsd (>=1.0.0 <=1.0.1), com.accelerate-experience:storm-rabbitmq (=1.0.0) +90 more potentially affected by CVE-2018-1331 via org.apache.storm:storm-core (>=0.9.3 <=1.1.2)

org.apache.storm:storm-core MAVEN version =0.9.3, =1.0.0, =0.1.0, =1.0, =1.0, =1.0, =1.3, =1.0, =1.0, =1.0, =1.0.0, =0.3.4, =0.4.1 - com.github.ptgoetz:flux =0.1.0 and more Source cves: CVE-2018-1331 Source advisory: OSV:GHSA-P8JX-X2VW-WM33...

org.apache.storm:flux-core (=1.1.0), org.apache.storm:storm-elasticsearch-examples (=1.1.0) +14 more potentially affected by CVE-2017-9799 via org.apache.storm:storm-core (=1.1.0)

org.apache.storm:storm-core MAVEN version =1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.storm:storm-core and may be impacted: - org.apache.storm:flux-core =1.1.0 - org.apache.storm:storm-elasticsearch-examples =1.1.0 -...

Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

GHSA-X825-RJWW-2245 Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...