Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.storm/storm-server@2.2.0
Typemaven
Namespaceorg.apache.storm
Namestorm-server
Version2.2.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.2.1
Latest_non_vulnerable_version2.2.1
Affected_by_vulnerabilities
0
url VCID-6gs5-dedd-2fey
vulnerability_id VCID-6gs5-dedd-2fey
summary 
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm and Apache Storm. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
references
0
reference_url http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html
reference_id
reference_type
scores
url http://packetstormsecurity.com/files/165019/Apache-Storm-Nimbus-2.2.0-Command-Execution.html
1
reference_url https://lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E
reference_id
reference_type
scores
url https://lists.apache.org/thread.html/r5fe881f6ca883908b7a0f005d35115af49f43beea7a8b0915e377859%40%3Cuser.storm.apache.org%3E
2
reference_url https://seclists.org/oss-sec/2021/q4/44
reference_id
reference_type
scores
url https://seclists.org/oss-sec/2021/q4/44
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-38294
reference_id CVE-2021-38294
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2021-38294
4
reference_url https://github.com/advisories/GHSA-6768-mcjc-8223
reference_id GHSA-6768-mcjc-8223
reference_type
scores
url https://github.com/advisories/GHSA-6768-mcjc-8223
fixed_packages
0
url pkg:maven/org.apache.storm/storm-server@2.2.1
purl pkg:maven/org.apache.storm/storm-server@2.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.storm/storm-server@2.2.1
aliases CVE-2021-38294, GHSA-6768-mcjc-8223
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6gs5-dedd-2fey
1
url VCID-9pwb-7wmy-5yh9
vulnerability_id VCID-9pwb-7wmy-5yh9
summary 
Deserialization of Untrusted Data
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE).
references
0
reference_url https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
reference_id
reference_type
scores
url https://lists.apache.org/thread.html/r8d45e74299897b6734dd0f788c46a631009ce2eeb731523386f7a253%40%3Cuser.storm.apache.org%3E
1
reference_url https://seclists.org/oss-sec/2021/q4/45
reference_id
reference_type
scores
url https://seclists.org/oss-sec/2021/q4/45
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-40865
reference_id CVE-2021-40865
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2021-40865
3
reference_url https://github.com/advisories/GHSA-w729-7633-2fw5
reference_id GHSA-w729-7633-2fw5
reference_type
scores
url https://github.com/advisories/GHSA-w729-7633-2fw5
fixed_packages
0
url pkg:maven/org.apache.storm/storm-server@2.2.1
purl pkg:maven/org.apache.storm/storm-server@2.2.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.storm/storm-server@2.2.1
aliases CVE-2021-40865, GHSA-w729-7633-2fw5
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9pwb-7wmy-5yh9
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.storm/storm-server@2.2.0