Path traversal in Apache Storm - CVE-2018-8008
Published: June 25, 2018 / Updated: July 2, 2018
Vulnerability identifier: #VU13540
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-8008
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Apache Foundation
Affected software:
Apache Storm
Apache Storm
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists due to path traversal when handling malicious input. A remote attacker can use a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames, conduct directory traversal attack and write arbitrary files in the system.
How to mitigate CVE-2018-8008
The vulnerability is addressed in the versions 1.1.3, 1.2.2.