Critical severity · published Oct 25, 2021
CVE-2021-40865
Unsafe Pre-Authentication Deserialization In Workers
9.8
CVSS
64.2%
EPSS
No
On KEV
Description
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)64.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Apache Storm · Apache Software Foundation
v1.0.0 before Apache Storm *; Apache Storm before v1.2.4 · source: vendor
ST
Storm · Apache
1.0.0 before 1.2.4; 2.1.0 before 2.1.1; 2.2.0 before 2.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40865
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40865
Mailing List
https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
Mailing List
https://seclists.org/oss-sec/2021/q4/45
More from Apache Storm
9.8
CVE-2021-38294
Shell Command Injection Vulnerability in Nimbus Thrift Server
5.5
CVE-2023-43123
Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files