CVE-2021-38294

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-38294
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38294.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-38294
Aliases
Downstream
Published
2021-10-25T13:15:07.957Z
Modified
2026-04-10T04:36:32.951462Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

References

Affected packages

Git / github.com/apache/storm

Affected ranges

Type
GIT
Repo
https://github.com/apache/storm
Events
Introduced
dba655a47aaad74f26b9bb9a75fa52c0eedd8b1e
Fixed
1bc944091b727e9a892bb36349231fcc57d9ea30
Introduced
79fc9b3e6aeec623b42d165536a936d28f2b12f1
Fixed
c5009d993ee049cd0b7c3fe0dad2fc8f700ddb5f
Introduced
bf1986345de5de605abb4fc7b6051fce762bbca5
Fixed
1d86ffd1adc1920e6788a76f017b2e2f873a7162
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.2.4"
        },
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.1.1"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.1"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v2.*
v2.1.0
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38294.json"