PT-2018-11743 · Apache · Apache Storm

Publicado 2018-06-05 · Atualizado 2018-10-17 · CVE-2018-1332

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Storm versions 1.0.6 and earlier Apache Storm versions 1.2.1 and earlier Apache Storm versions 1.1.2 and earlier

Description The issue allows a user to impersonate another user when communicating with some Storm Daemons.

Recommendations For Apache Storm versions 1.0.6 and earlier, update to a version later than 1.0.6 to resolve the issue. For Apache Storm versions 1.2.1 and earlier, update to a version later than 1.2.1 to resolve the issue. For Apache Storm versions 1.1.2 and earlier, update to a version later than 1.1.2 to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1332

GHSA-Q35P-CHC6-7X57

Produtos afetados

Apache Storm

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-1332 · Nota de Segurança
• http://securityfocus.com/bid/104399 · Nota
• https://osv.dev/vulnerability/GHSA-q35p-chc6-7x57 · Aviso do Fabricante
• https://github.com/advisories/GHSA-q35p-chc6-7x57 · Nota
• https://lists.apache.org/thread.html/50f1d6a7af27f49d2e498a9ab2975685302cd8ca47000b7c38f339a4@%3Cdev.storm.apache.org%3E · Nota
• https://lists.apache.org/thread.html/50f1d6a7af27f49d2e498a9ab2975685302cd8ca47000b7c38f339a4%40%3Cdev.storm.apache.org%3E · Nota
• https://osv.dev/vulnerability/CVE-2018-1332 · Aviso do Fabricante