A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
{ "nvd_published_at": "2021-10-25T13:15:00Z", "github_reviewed_at": "2021-10-26T17:52:52Z", "severity": "CRITICAL", "github_reviewed": true, "cwe_ids": [ "CWE-74", "CWE-78" ] }