Apache Storm remote code execution vulnerability

CRITICAL 9.8CVE-2015-3188 · GHSA-cg5h-q983-4rww · Published 13/01/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.storm:storm Maven	`≥ 0.10.0-beta, < 0.10.0-beta1`	`0.10.0-beta1`
storm apache	`= 0.10.0`	No fix yet

Description

The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.

NVD description

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2015-3188 · ADVISORY
apache/storm · WEB
apache/storm · WEB
web.archive.org/web/20151014213052/http://www.securitytracker.com/id/1032695 · WEB
web.archive.org/web/20171202122914/http://www.securityfocus.com/archive/1/535804/100/0/threaded · WEB
packetstormsecurity.com/files/132417/Apache-Storm-0.10.0-beta-Code-Execution.html · WEB
securityfocus.com/archive/1/535804/100/0/threaded
securitytracker.com/id/1032695 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free