Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1yOXB2LWhnNjQtanFycM4AAhcY
Exposure of Sensitive Information in Apache Storm Logviewer
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.
Permalink: https://github.com/advisories/GHSA-r9pv-hg64-jqrpJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yOXB2LWhnNjQtanFycM4AAhcY
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago
CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-r9pv-hg64-jqrp, CVE-2019-0202
References:
- https://nvd.nist.gov/vuln/detail/CVE-2019-0202
- https://lists.apache.org/thread.html/220f1a77ff20749326a4c130446c5521db854da0afe81d1974b8109f@%3Cuser.storm.apache.org%3E
- https://github.com/advisories/GHSA-r9pv-hg64-jqrp
Affected Packages
maven:org.apache.storm:storm-core
Dependent packages: 190Dependent repositories: 1,756
Downloads:
Affected Version Ranges: >= 0.9.1-incubating, < 1.2.3
Fixed in: 1.2.3
All affected versions: 0.9.1-incubating, 0.9.3, 0.9.4, 0.9.5, 0.9.6, 0.9.7, 0.10.0, 0.10.1, 0.10.2, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.2.0, 1.2.1, 1.2.2
All unaffected versions: 1.2.3, 1.2.4, 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.5.0, 2.6.0, 2.6.1, 2.6.2