The vulnerability of the user interface (UI) of the Apache Storm distributed processing platform allows a hacker to execute arbitrary code.

The vulnerability of the user interface UI of the Apache Storm distributed processing platform’s software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to remotely connect to the UI and execute arbitrary code...

Apache Storm Directory Traversal Vulnerability

Apache Storm is the United States Apache Apache Software Foundation of a set of Clojure Concurrent Programming Language development of free open-source distributed real-time computing system. log viewer is one of the log viewer tool. A directory traversal vulnerability exists in the log viewer in...

Directory traversal

Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter to log...

CVE-2014-0115

The CVE-2014-0115 entry describes a directory traversal vulnerability in the log viewer of Apache Storm 0.9.0.1. An attacker can use a .. sequence in the log file parameter to read arbitrary files, potentially exposing sensitive data. The connected sources reiterate this flaw (path traversal in A...

CVE-2014-0115

Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter to log...

Apache Storm Code Execution Vulnerability

Apache Storm is a free and open source distributed real-time computing system. Apache Storm suffers from a code execution vulnerability that can be exploited by an attacker to execute arbitrary code in the context of different users...

CVE-2017-9799

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

CVE-2017-9799

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

Code injection

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

CVE-2017-9799

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

CVE-2017-9799

CVE-2017-9799 affects Apache Storm 1.x prior to 1.0.4 and 1.1.x prior to 1.1.1. The issue allows a topology owner to trick the supervisor into launching a worker as a different, non-root user, enabling exposure of that user’s credentials. Impact is described as potential credential compromise and...

CVE-2015-3188

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors...

Code injection

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3188

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-3188

The CVE-2015-3188 issue affects Apache Storm UI daemon: Storm 0.10.0-beta (before 0.10.0-beta1) allows remote attackers to execute arbitrary code via unspecified vectors. The root cause is the UI daemon handling requests in a way that permits code execution when exposed to unauthenticated/remote ...

Apache Storm code execution

Code execution on the web server...

[CVE-2015-3188] Apache Storm remote code execution vulnerability

CVE-2015-3188: Apache Storm remote code execution vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Storm 0.10.0-beta Description: The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web serve...

Apache Storm User Interface Arbitrary Code Execution Vulnerability

Apache Storm is a free, open source distributed real-time computing system. Apache Storm has a security vulnerability that allows a remote user to connect to the UI backend program and execute arbitrary code on the system. Using Kerberos authentication for users, remote users can spoof arbitrary...