stormGHSA-cg5h-q983-4rww

Apache Storm remote code execution vulnerability

CVE-2015-3188 · Published May 14, 2022 · updated Nov 8, 2023

Critical9.8

Fix: upgrade to 0.10.0-beta1 or later

The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.

Affected versions

Package	Affected	Fixed in
org.apache.storm:storm Maven	>= 0.10.0-beta, < 0.10.0-beta1	0.10.0-beta1

Details and references

CVSS 3.0: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Also known as: CVE-2015-3188

More storm advisories

All storm

High 7.5May 17, 2022

Apache Storm log viewer path traversal vulnerabilityCVE-2014-0115no fix yet Critical 9.8Oct 27, 2021

Deserialization of Untrusted Data leading to Remote Code Execution in Apache StormCVE-2021-40865fixed in 1.2.4 +2 Critical 9.8Oct 27, 2021

Command injection leading to Remote Code Execution in Apache StormCVE-2021-38294fixed in 1.2.4 +2