CVE-2018-1331

8.8 highEPSS 4.4%

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 4.4% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
Published: 2018-07-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:storm

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-p8jx-x2vw-wm33	Maven	org.apache.storm:storm-core	>=1.2.0 <1.2.2	1.2.2
GHSA-p8jx-x2vw-wm33	Maven	org.apache.storm:storm-core	<1.1.3	1.1.3

References

http://storm.apache.org/2018/06/04/storm113-released.html
http://storm.apache.org/2018/06/04/storm122-released.html
http://www.openwall.com/lists/oss-security/2018/07/10/4
http://www.securityfocus.com/bid/104732
http://www.securitytracker.com/id/1041273

Check your stack JSON