High severity8.8NVD Advisory· Published Jul 10, 2018· Updated Jun 17, 2026
CVE-2018-1331
CVE-2018-1331
Description
In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.storm:storm-coreMaven | >= 1.2.0, < 1.2.2 | 1.2.2 |
org.apache.storm:storm-coreMaven | < 1.1.3 | 1.1.3 |
Affected products
2Patches
Vulnerability mechanics
References
7- storm.apache.org/2018/06/04/storm113-released.htmlnvdVendor AdvisoryWEB
- storm.apache.org/2018/06/04/storm122-released.htmlnvdVendor AdvisoryWEB
- www.openwall.com/lists/oss-security/2018/07/10/4nvdMailing ListThird Party AdvisoryWEB
- www.securityfocus.com/bid/104732nvdThird Party AdvisoryVDB EntryWEB
- www.securitytracker.com/id/1041273nvdThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-p8jx-x2vw-wm33ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-1331ghsaADVISORY
News mentions
0No linked articles in our index yet.