What is GHSA-cg5h-q983-4rww?

GHSA-cg5h-q983-4rww is a security advisory published by GitHub Security Advisories with Critical severity. Apache Storm remote code execution vulnerability

Which CVE IDs does GHSA-cg5h-q983-4rww cover?

GHSA-cg5h-q983-4rww covers the following CVE IDs: CVE-2015-3188. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cg5h-q983-4rww?

GHSA-cg5h-q983-4rww has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-cg5h-q983-4rww?

GHSA-cg5h-q983-4rww affects 1 product, including: maven/org.apache.storm:storm:= 0.10.0-beta.

GHSA-cg5h-q983-4rwwCriticalCVSS 9.8

Apache Storm remote code execution vulnerability

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

August 2, 2023

🔗 CVE IDs covered (1)

CVE-2015-3188 →

📋 Description

The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.

🎯 Affected products1

maven/org.apache.storm:storm:= 0.10.0-beta

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2015-3188
http://packetstormsecurity.com/files/132417/Apache-Storm-0.10.0-beta-Code-Execution.html
https://github.com/apache/storm/blob/v0.10.0-beta1/SECURITY.md
https://github.com/apache/storm/blob/v0.10.0-beta1/STORM-UI-REST-API.md
https://web.archive.org/web/20151014213052/http://www.securitytracker.com/id/1032695
https://web.archive.org/web/20171202122914/http://www.securityfocus.com/archive/1/535804/100/0/threaded
https://github.com/advisories/GHSA-cg5h-q983-4rww