Not rated
CVE-2018-1331 In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker…
Description
In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Storm | Versions not published |
References
- storm.apache.org storm.apache.org
- [oss-security] 20180710 CVE-2018-1331: Apache Storm remote code execution vulnerability www.openwall.com
- storm.apache.org storm.apache.org
- 104732 www.securityfocus.com
- 1041273 www.securitytracker.com
Timeline
- Published
- Last modified
Other CVEs of Apache Storm
The 7 CVEs of Apache Storm →
CVE-2023-43123
On unix-like systems, the temporary directory is shared between all user
Not rated
CVE-2021-40865
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing…
Not rated
CVE-2021-38294
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and…
Not rated
CVE-2018-1332
Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that…
Not rated