CVE-2017-9799
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 4.9%
probabilidad de explotación
4.9%top 8% de las CVE
explotación observada
noninguna fuente lo reporta
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Productos afectados
Apache Software Foundation · Apache Storm