org.apache.storm/storm vulnerabilities

Latest org.apache.storm/storm CVEs

Newest publication first

1. CVE-2021-40865 Unsafe Pre-Authentication Deserialization In Workers

   Published 2021-10-25

   Critical·CVSS 9.8 EPSS 64.2%

   An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1....

2. CVE-2021-38294 Shell Command Injection Vulnerability in Nimbus Thrift Server

   Published 2021-10-25

   Critical·CVSS 9.8 EPSS 83.8% Framework module Public exploit

   A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

3. CVE-2014-0115 Apache Storm log viewer path traversal vulnerability

   Published 2017-10-30

   High·CVSS 7.5 EPSS 5.3%

   Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.

4. CVE-2015-3188 Apache Storm remote code execution vulnerability

   Published 2017-01-13

   Critical·CVSS 9.8 EPSS 14.4% Public exploit

   The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.