In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.
[
{
"product": "Storm",
"vendor": "Apache",
"versions": [
{
"status": "affected",
"version": "1.1.0 to 1.2.2"
}
]
}
]