Path traversal in Apache Storm - CVE-2018-8008
Published: June 25, 2018 / Updated: July 2, 2018
Vulnerability identifier: #VU13540
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-8008
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists due to path traversal when handling malicious input. A remote attacker can use a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames, conduct directory traversal attack and write arbitrary files in the system.
Affected software
Apache Storm
How to mitigate CVE-2018-8008
The vulnerability is addressed in the versions 1.1.3, 1.2.2.
Apache Storm - addressed in versions 1.1.3, 1.2.2