QwikSec

Security Database

CVE

CWE

Training

CVE-2018-1331

Published: Jul 10, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.

Vendor	Product	Versions
Apache Software Foundation	Apache Storm	affected `0.10.0 through 0.10.2` affected `1.0.0 through 1.0.6` affected `1.1.0 through 1.1.2` affected `1.2.0 through 1.2.1`

References

http://storm.apache.org/2018/06/04/storm122-released.html

x_refsource_CONFIRM

[oss-security] 20180710 CVE-2018-1331: Apache Storm remote code execution vulnerability

mailing-list

x_refsource_MLIST

http://storm.apache.org/2018/06/04/storm113-released.html

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

vdb-entry

x_refsource_SECTRACK

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.