PT-2015-3343 · Apache · Apache Storm

Published 2015-06-22 · Updated 2022-05-14 · CVE-2015-3188

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Storm version 0.10.0

Description The issue is related to the UI daemon in Apache Storm, which has insufficient access controls. This allows remote attackers to execute arbitrary code. With Kerberos authentication, this could potentially allow impersonation of arbitrary users on other systems, including HDFS and HBase.

Recommendations For Apache Storm version 0.10.0, update to a version after 0.10.0-beta1 to resolve the issue. As a temporary workaround, consider restricting access to the UI daemon to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-02543

CVE-2015-3188

GHSA-CG5H-Q983-4RWW

Affected Products

Apache Storm

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2015-3188 · Security Note
• https://osv.dev/vulnerability/GHSA-cg5h-q983-4rww · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02543 · Security Note
• https://github.com/apache/storm/blob/v0.10.0-beta1/SECURITY.md · Note
• https://github.com/apache/storm/blob/v0.10.0-beta1/STORM-UI-REST-API.md · Note
• http://securityfocus.com/archive/1/535804/100/0/threaded · Note
• https://web.archive.org/web/20151014213052/http://securitytracker.com/id/1032695 · Note
• https://web.archive.org/web/20171202122914/http://securityfocus.com/archive/1/535804/100/0/threaded · Note
• http://securitytracker.com/id/1032695 · Note
• http://securityfocus.com/archive/1/archive/1/535804/100/0/threaded · Note
• http://packetstormsecurity.com/files/132417/Apache-Storm-0.10.0-beta-Code-Execution.html · Note