Skip to content
Sign in
Not rated

CVE-2019-0202 The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm

Description

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.

Affected products and versions

Product Affected versions Fixed in
Storm Versions not published

Other CVEs of Storm

The 2 CVEs of Storm →
CVE-2018-11779 In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is… Not rated
Track this CVE