User Impersonation Vulnerability in Apache Storm by The Apache Software Foundation
CVE-2018-1332

6.5MEDIUM

Key Information:

Vendor
Apache
Status
Apache Storm
Vendor
CVE Published:
5 June 2018

Summary

A security flaw in Apache Storm versions 1.0.6, 1.1.2, and 1.2.1 allows an attacker to impersonate other users during interactions with Storm Daemons. This can lead to unauthorized access and manipulation of data within the system, potentially compromising the integrity of user sessions and sensitive information.

Affected Version(s)

Apache Storm Apache Storm 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier

References

https://lists.apache.org/thread.html/50f1d6a7af27f49d2e49...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104399
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.