CVE-2021-40865CWE-502

CVE-2021-40865: vulnerability in Apache Storm

Unsafe Pre-Authentication Deserialization In Workers

Published · Updated

Follow this CVE+ Monitor Apache Storm+ Monitor org.apache.storm:storm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

15Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 64%
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Affected products
Apache Software Foundation · Apache Storm
Related CVEs — Apache Storm

In the same product, most dangerous first.

CVE-2021-38294—Shell Command Injection Vulnerability in Nimbus Thrift ServerEPSS 83.8%CVE-2017-9799—CVE-2017-9799EPSS 4.9%CVE-2018-1331—CVE-2018-1331EPSS 4.4%CVE-2018-8008—CVE-2018-8008EPSS 2.2%CVE-2018-1332—CVE-2018-1332EPSS 1.4%CVE-2023-43123—Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary filesEPSS 0.4%