CVE-2021-38294

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-38294
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38294.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-38294
Aliases
Downstream
Published
2021-10-25T13:15:07.957Z
Modified
2026-02-13T02:27:20.147672Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

References

Affected packages

Git / github.com/apache/storm

Affected ranges

Type
GIT
Repo
https://github.com/apache/storm
Events
Introduced
79fc9b3e6aeec623b42d165536a936d28f2b12f1
Fixed
c5009d993ee049cd0b7c3fe0dad2fc8f700ddb5f
Introduced
bf1986345de5de605abb4fc7b6051fce762bbca5
Fixed
1d86ffd1adc1920e6788a76f017b2e2f873a7162
Introduced
dba655a47aaad74f26b9bb9a75fa52c0eedd8b1e
Fixed
1bc944091b727e9a892bb36349231fcc57d9ea30

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v2.*
v2.1.0
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-38294.json"