CVEvulnerability

CVE-2021-40865

9.8 CRITICAL Published 2021-10-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-10-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-502

Description

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Affected configurations

• apache storm (>= 1.0.0 < 1.2.4) • apache storm (>= 2.1.0 < 2.1.1) • apache storm (>= 2.2.0 < 2.2.1)

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References