Exposure of Sensitive Information in Apache Storm Logviewer

2022-05-2416:51:28

Google

osv.dev

0.001 Low

EPSS

Percentile

30.0%

JSON

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host’s file system that were not intended to be accessible via these endpoints.

CPENameOperatorVersion
org.apache.storm:storm-coreeq1.1.0
org.apache.storm:storm-coreeq0.9.7
org.apache.storm:storm-coreeq1.2.1
org.apache.storm:storm-coreeq0.10.1
org.apache.storm:storm-coreeq0.9.3
org.apache.storm:storm-coreeq0.10.0-beta
org.apache.storm:storm-coreeq1.0.2
org.apache.storm:storm-coreeq1.2.2
org.apache.storm:storm-coreeq0.9.5
org.apache.storm:storm-coreeq0.9.2-incubating

Name	Operator	Version
org.apache.storm:storm-core	eq	1.1.0
org.apache.storm:storm-core	eq	0.9.7
org.apache.storm:storm-core	eq	1.2.1
org.apache.storm:storm-core	eq	0.10.1
org.apache.storm:storm-core	eq	0.9.3
org.apache.storm:storm-core	eq	0.10.0-beta
org.apache.storm:storm-core	eq	1.0.2
org.apache.storm:storm-core	eq	1.2.2
org.apache.storm:storm-core	eq	0.9.5
org.apache.storm:storm-core	eq	0.9.2-incubating