High severity · published Aug 9, 2017
CVE-2017-9799
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to…
8.8
CVSS
4.9%
EPSS
No
On KEV
Description
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.9% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Storm · Apache
1.0; 1.0.1; 1.0.2; 1.0.3; 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9799
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9799
Third Party Advisory
http://www.securityfocus.com/bid/100235
Third Party Advisory
http://www.securitytracker.com/id/1039116
lists.apache.org
https://lists.apache.org/thread.html/b9125bf507ed6f2ca6e85ba1a4b44e232aa70eeddfba2a9d8a954127%40%3Cdev.storm.apache.org%3E
More from Storm
9.8
CVE-2021-40865
Unsafe Pre-Authentication Deserialization In Workers
9.8
CVE-2021-38294
Shell Command Injection Vulnerability in Nimbus Thrift Server
9.8
CVE-2018-11779
In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user…
9.8
CVE-2015-3188
The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors
8.8
CVE-2026-35337
Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling