PT-2015-3343 · Apache · Apache Storm

Publicado 2015-06-22 · Atualizado 2022-05-14 · CVE-2015-3188

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Storm version 0.10.0

Description The issue is related to the UI daemon in Apache Storm, which has insufficient access controls. This allows remote attackers to execute arbitrary code. With Kerberos authentication, this could potentially allow impersonation of arbitrary users on other systems, including HDFS and HBase.

Recommendations For Apache Storm version 0.10.0, update to a version after 0.10.0-beta1 to resolve the issue. As a temporary workaround, consider restricting access to the UI daemon to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-02543

CVE-2015-3188

GHSA-CG5H-Q983-4RWW

Produtos afetados

Apache Storm

Referências · 11

• https://github.com/apache/storm/blob/v0.10.0-beta1/SECURITY.md · Nota
• https://github.com/apache/storm/blob/v0.10.0-beta1/STORM-UI-REST-API.md · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3188 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-cg5h-q983-4rww · Aviso do Fabricante
• http://securityfocus.com/archive/1/535804/100/0/threaded · Nota
• https://web.archive.org/web/20151014213052/http://securitytracker.com/id/1032695 · Nota
• https://web.archive.org/web/20171202122914/http://securityfocus.com/archive/1/535804/100/0/threaded · Nota
• https://bdu.fstec.ru/vul/2017-02543 · Nota de Segurança
• http://securitytracker.com/id/1032695 · Nota
• http://securityfocus.com/archive/1/archive/1/535804/100/0/threaded · Nota
• http://packetstormsecurity.com/files/132417/Apache-Storm-0.10.0-beta-Code-Execution.html · Nota