CVE-2018-11779

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
ApacheStorm1.1.0 to 1.2.2

References

Timeline

Published
Jul 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-11788.8This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interactiCVE-2018-117809.8A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.CVE-2018-117817.8Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.CVE-2018-117826.5In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed rCVE-2018-117837.5sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin.CVE-2018-117844.3When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directoCVE-2018-117856.5Missing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but unauthorized user to inject random data into aCVE-2018-117868.8In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any useCVE-2018-117878.1In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/consoCVE-2018-117889.8Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folCVE-2018-117897.5When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. ExampCVE-2018-11796.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User i