Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/59391?format=api",
    "purl": "pkg:maven/org.apache.storm/storm-server@2.2.0",
    "type": "maven",
    "namespace": "org.apache.storm",
    "name": "storm-server",
    "version": "2.2.0",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": true,
    "next_non_vulnerable_version": "2.2.1",
    "latest_non_vulnerable_version": "2.2.1",
    "affected_by_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41634?format=api",
            "vulnerability_id": "VCID-6gs5-dedd-2fey",
            "summary": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')\nA Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm and Apache Storm. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.",
            "references": [
                {
                    "reference_url": "http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html"
                },
                {
                    "reference_url": "https://lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E"
                },
                {
                    "reference_url": "https://seclists.org/oss-sec/2021/q4/44",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://seclists.org/oss-sec/2021/q4/44"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38294",
                    "reference_id": "CVE-2021-38294",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38294"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-6768-mcjc-8223",
                    "reference_id": "GHSA-6768-mcjc-8223",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-6768-mcjc-8223"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/59394?format=api",
                    "purl": "pkg:maven/org.apache.storm/storm-server@2.2.1",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.storm/storm-server@2.2.1"
                }
            ],
            "aliases": [
                "CVE-2021-38294",
                "GHSA-6768-mcjc-8223"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6gs5-dedd-2fey"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41631?format=api",
            "vulnerability_id": "VCID-9pwb-7wmy-5yh9",
            "summary": "Deserialization of Untrusted Data\nAn Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE).",
            "references": [
                {
                    "reference_url": "https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E"
                },
                {
                    "reference_url": "https://seclists.org/oss-sec/2021/q4/45",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://seclists.org/oss-sec/2021/q4/45"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40865",
                    "reference_id": "CVE-2021-40865",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40865"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-w729-7633-2fw5",
                    "reference_id": "GHSA-w729-7633-2fw5",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-w729-7633-2fw5"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/59394?format=api",
                    "purl": "pkg:maven/org.apache.storm/storm-server@2.2.1",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.storm/storm-server@2.2.1"
                }
            ],
            "aliases": [
                "CVE-2021-40865",
                "GHSA-w729-7633-2fw5"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9pwb-7wmy-5yh9"
        }
    ],
    "fixing_vulnerabilities": [],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.storm/storm-server@2.2.0"
}