CVE-2017-9799
CVE-2017-9799
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 4.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
09 Aug 2017Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Affected products
Apache Software Foundation · Apache StormWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →