#VU13540 Path traversal in Apache Storm - CVE-2018-8008
Published: June 25, 2018 / Updated: July 2, 2018
Vulnerability identifier: #VU13540
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-8008
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Apache Storm
Apache Storm
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The vulnerability exists due to path traversal when handling malicious input. A remote attacker can use a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames, conduct directory traversal attack and write arbitrary files in the system.
Remediation
The vulnerability is addressed in the versions 1.1.3, 1.2.2.