WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: Full✕Vendor org.apache.storm✕
Overview 5 matches · 0 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
5matches 0exploited0.0% 0CISA KEV0.0% 2public PoC40.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 5 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 3 60.0% High 2 40.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 20.0% Proof of concept only 1 20.0% Forecast only 0 0.0% No public exploit 3 60.0%
split by peak 2 / year
Protected by Waratek: 5 High: 2Critical: 3 blocked by ARMR today: 5 No public exploit: 3Proof of concept only: 1Working exploit published: 1
20171 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20180 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20200 20212 Protected by Waratek2 Critical2 blocked by ARMR today2 Working exploit published1 Proof of concept only1 20220 20230 20240 20250 20261 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
2017201820192020202120222023202420252026
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-35337 High 2026-04-13 Protected by Waratek No public exploit Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. Description: When processing topology credentials submitted via the Nimbus Thrift API, Storm deserializes the base64-encoded TGT blob using ObjectInputStream.readObject() without any class filtering or validation. An authenticated user with topology submission rights could supply a crafted serialized object in the "TGT" credential field, leading to remote code execution in both the Nimbus and Worker JVMs. Mitigation: 2.x users should upgrade to 2.8.6. Users who cannot upgrade immediately should monkey-patch an ObjectInputFilter allow-list to ClientAuthUtils.deserializeKerberosTicket() restricting deserialized classes to javax.security.auth.kerberos.KerberosTicket and its known dependencies. A guide on how to do this is available in the release notes of 2.8.6. Credit: This issue was discovered by K.
CVE-2021-40865 Critical 2021-10-25 Protected by Waratek Proof of concept only An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
CVE-2021-38294 Critical 2021-10-25 Protected by Waratek Working exploit published A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
CVE-2018-11779 Critical 2019-07-26 Protected by Waratek No public exploit In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.
CVE-2014-0115 High 2017-10-30 Protected by Waratek No public exploit Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.