CVE-2018-1331

moderate-risk
Published 2018-07-10

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.

Do I need to act?

~
5.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Apache

References (10)

Vendor Advisory http://storm.apache.org/2018/06/04/storm113-released.html
Vendor Advisory http://storm.apache.org/2018/06/04/storm122-released.html
Mailing List http://www.openwall.com/lists/oss-security/2018/07/10/4
Third Party Advisory http://www.securityfocus.com/bid/104732
Third Party Advisory http://www.securitytracker.com/id/1041273
Vendor Advisory http://storm.apache.org/2018/06/04/storm113-released.html
Vendor Advisory http://storm.apache.org/2018/06/04/storm122-released.html
Mailing List http://www.openwall.com/lists/oss-security/2018/07/10/4
Third Party Advisory http://www.securityfocus.com/bid/104732
Third Party Advisory http://www.securitytracker.com/id/1041273
43
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 8/34 · Low
Exposure 5/34 · Minimal