CVE-2017-9799

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Storm	1.0.0 through 1.0.3; 1.1.0

References

http://www.securityfocus.com/bid/100235Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039116Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/b9125bf507ed6f2ca6e85ba1a4b44e232aa70eeddfba2a9d8a954127%40%3Cdev.storm.apache.org%3E
http://www.securityfocus.com/bid/100235Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039116Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/b9125bf507ed6f2ca6e85ba1a4b44e232aa70eeddfba2a9d8a954127%40%3Cdev.storm.apache.org%3E

Timeline

Published: Aug 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-98009.8A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha CVE-2017-98017.5When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitra CVE-2017-98026.1The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input stri CVE-2017-98037.5Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-CVE-2017-98047.5In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValida CVE-2017-98058.1The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea CVE-2017-98067.8A vulnerability in the OpenOffice Writer DOC file parser before 4.1.4, and specifically in the WW8Fonts Constructor, allows attackers to cra CVE-2017-98079.8An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/con CVE-2017-98086.1OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).CVE-2017-98095.3OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Information Exposure.CVE-2017-98108.8There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Crit CVE-2017-98119.8The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critic