CVE-2021-40865
critical · 9.8An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
9.8
CVSS
65.6%
EPSS (exploit prob.)
99th
EPSS percentile
2021-10-25
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apache | storm | >= 1.0.0, < 1.2.4 |
| apache | storm | >= 2.1.0, < 2.1.1 |
| apache | storm | >= 2.2.0, < 2.2.1 |
Check a specific version with /api/v1/cve/match.
References
- https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
- https://seclists.org/oss-sec/2021/q4/45
- https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
- https://seclists.org/oss-sec/2021/q4/45
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-40865