AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

stormGHSA-cpp8-r8pr-wv4v

Apache Storm log viewer path traversal vulnerability

storm

CVE-2014-0115 · Published May 17, 2022 · updated Nov 8, 2023

High7.5
No fix yet
GitHub advisory

Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.

Affected versions

PackageAffectedFixed in
org.apache.storm:storm
Maven
<= 0.9.0.1No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22
Also known as
CVE-2014-0115

More storm advisories

All storm
Critical 9.8May 14, 2022Apache Storm remote code execution vulnerabilityCVE-2015-3188fixed in 0.10.0-beta1Critical 9.8Oct 27, 2021Deserialization of Untrusted Data leading to Remote Code Execution in Apache StormCVE-2021-40865fixed in 1.2.4 +2Critical 9.8Oct 27, 2021Command injection leading to Remote Code Execution in Apache StormCVE-2021-38294fixed in 1.2.4 +2