CVE-2018-1331

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Storm	0.10.0 through 0.10.2; 1.0.0 through 1.0.6; 1.1.0 through 1.1.2; 1.2.0 through 1.2.1

References

http://storm.apache.org/2018/06/04/storm113-released.htmlVendor Advisory
http://storm.apache.org/2018/06/04/storm122-released.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2018/07/10/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/104732Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041273Third Party Advisory, VDB Entry
http://storm.apache.org/2018/06/04/storm113-released.htmlVendor Advisory
http://storm.apache.org/2018/06/04/storm122-released.htmlVendor Advisory
http://www.openwall.com/lists/oss-security/2018/07/10/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/104732Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041273Third Party Advisory, VDB Entry

Timeline

Published: Jul 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-133106.1Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's usern CVE-2018-133119.8System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST CVE-2018-133126.1Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "CVE-2018-133136.5In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.ht CVE-2018-133149.8System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST CVE-2018-133159.8Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an CVE-2018-133169.8System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST CVE-2018-133176.1Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user b CVE-2018-133187.2System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the CVE-2018-133197.5Incorrect access control in get_portal_info in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to determine sensitive device informat CVE-2018-13326.5Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to i CVE-2018-133207.2System Command Injection in network.set_auth_settings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands v