GitHub Advisoryadvisory · Maven

GHSA-cpp8-r8pr-wv4v Apache Storm log viewer path traversal vulnerability

HIGH Published 2022-05-17 Modified 2023-08-16 Official page ↗
Aliases
CVE-2014-0115
Ecosystem
Maven
Packages
org.apache.storm:storm
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-08-16

Affected packages

• Maven org.apache.storm:storm: <= 0.9.0.1 (no fix yet)

Description

Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a `..` (dot dot) in the file parameter to log.

Related

Alias · CVE (1)

  • CVE-2014-0115 Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References