Critical severity9.8NVD Advisory· Published Oct 25, 2021· Updated Jun 17, 2026
CVE-2021-38294
CVE-2021-38294
Description
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.storm:stormMaven | >= 2.2.0, < 2.2.1 | 2.2.1 |
org.apache.storm:stormMaven | >= 2.0.0, < 2.1.1 | 2.1.1 |
org.apache.storm:stormMaven | >= 1.0.0, < 1.2.4 | 1.2.4 |
Affected products
3Patches
Vulnerability mechanics
References
5- packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.htmlnvdExploitThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-6768-mcjc-8223ghsaADVISORY
- lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3EnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-38294ghsaADVISORY
- seclists.org/oss-sec/2021/q4/44nvdMailing ListThird Party AdvisoryWEB
News mentions
0No linked articles in our index yet.