GHSA-6768-mcjc-8223

Suggest an improvement
Source
https://github.com/advisories/GHSA-6768-mcjc-8223
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-6768-mcjc-8223/GHSA-6768-mcjc-8223.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6768-mcjc-8223
Aliases
Published
2021-10-27T18:51:22Z
Modified
2023-11-08T04:06:27.082122Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Command injection leading to Remote Code Execution in Apache Storm
Details

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Database specific
{
    "nvd_published_at": "2021-10-25T13:15:00Z",
    "github_reviewed_at": "2021-10-26T17:52:52Z",
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-74",
        "CWE-78"
    ]
}
References

Affected packages

Maven / org.apache.storm:storm

Package

Name
org.apache.storm:storm
View open source insights on deps.dev
Purl
pkg:maven/org.apache.storm/storm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.2.1

Affected versions

2.*

2.2.0

Maven / org.apache.storm:storm

Package

Name
org.apache.storm:storm
View open source insights on deps.dev
Purl
pkg:maven/org.apache.storm/storm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.1

Affected versions

2.*

2.0.0
2.1.0

Maven / org.apache.storm:storm

Package

Name
org.apache.storm:storm
View open source insights on deps.dev
Purl
pkg:maven/org.apache.storm/storm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.0.0
Fixed
1.2.4

Affected versions

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.2.1
1.2.2
1.2.3