GitHub Advisoryadvisory · Maven
GHSA-cg5h-q983-4rww Apache Storm remote code execution vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2015-3188
- Ecosystem
- Maven
- Packages
- org.apache.storm:storm
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Reviewed
- 2023-08-02
Affected packages
• Maven org.apache.storm:storm: >= 0.10.0-beta, < 0.10.0-beta1 → fixed in 0.10.0-beta1
Description
The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.
Related
Alias · CVE (1)
- CVE-2015-3188 The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-3188 advisory
- https://github.com/apache/storm/blob/v0.10.0-beta1/SECURITY.md web
- https://github.com/apache/storm/blob/v0.10.0-beta1/STORM-UI-REST-API.md web
- https://web.archive.org/web/20151014213052/http://www.securitytracker.com/id/1032695 web
- https://web.archive.org/web/20171202122914/http://www.securityfocus.com/archive/1/535804/100/0/threaded web
- http://packetstormsecurity.com/files/132417/Apache-Storm-0.10.0-beta-Code-Execution.html web