CVE-2021-38294

Published: 25/10/2021 Updated: 18/10/2022

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 670

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x before 2.2.1 and Apache Storm 1.x before 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache storm

Severity: high Description: A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2x prior to 221 and Apache Storm 1x prior to 124 A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication Mitigation: Apache Storm 22x users should upgr ...

CWE-78 https://seclists.org/oss-sec/2021/q4/44 https://lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html https://nvd.nist.gov http://seclists.org/oss-sec/2021/q4/44

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-38294

Vulnerability Summary

Vulnerability Trend

Mailing Lists

References

Vulmon Search

About

Products

Connect