| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.storm:storm | ≥ 0.10.0-beta, < 0.10.0-beta1 | 0.10.0-beta1 |
| storm | = 0.10.0 |
The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free