CVE-2018-11779

CRITICAL

Apache Storm < 1.2.2 - Insecure Deserialization

Title source: rule

Description

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.

References (1)

[Mailing List] https://lists.apache.org/thread.html/3e4f704c4bd9296405a07a0290b8cbb6cbf5046e277efe6d93280a98%40%3Cuser.storm.apache.org%3E

Scores

CVSS v3 9.8

EPSS 0.0147

EPSS Percentile 80.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (3)

apache/storm < 1.2.2

org.apache.storm/storm-kafka < 1.2.3Maven

org.apache.storm/storm-kafka-client < 1.2.3Maven

Timeline

Published Jul 26, 2019

Tracked Since Feb 18, 2026