CVE-2021-40865

Description

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

46.22

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-40865,CVE-2021-38294 are fixed in Apache-storm 2.2.1	Windows
Vulnerabilities CVE-2021-40865,CVE-2021-38294 are fixed in Apache-storm 1.2.4	Windows
Vulnerabilities CVE-2021-40865,CVE-2021-38294 are fixed in Apache-storm 2.1.1	Windows
Vulnerabilities CVE-2021-40865,CVE-2021-38294 are fixed in Apache-storm for Linux 2.2.1	Linux
Vulnerabilities CVE-2021-40865,CVE-2021-38294 are fixed in Apache-storm for Linux 1.2.4	Linux
Vulnerabilities CVE-2021-40865,CVE-2021-38294 are fixed in Apache-storm for Linux 2.1.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234