{"id":"CVE-2015-3188","aliases":["EUVD-2022-3571","GHSA-cg5h-q983-4rww"],"status":"published","title":"Apache Storm remote code execution vulnerability","description":"The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.14399,"percentile":0.96641,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2017-01-13T15:00:00Z","modified":"2026-06-17T00:25:30Z","fixes":[{"ecosystem":"Maven","package":"org.apache.storm:storm","fixed_in":["0.10.0-beta1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.storm:storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0-beta"},{"last_affected":"0.10.0-beta"},{"fixed":"0.10.0-beta1"}]}],"versions":["0.10.0-beta"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.storm:storm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.0-beta"},{"fixed":"0.10.0-beta1"}]}],"versions":["0.10.0-beta"]}],"products":[{"vendor":"apache","product":"storm"}],"references":[{"url":"http://www.securitytracker.com/id/1032695","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/535804/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://packetstormsecurity.com/files/132417/Apache-Storm-0.10.0-beta-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3188","tags":["advisory"]},{"url":"https://github.com/apache/storm/blob/v0.10.0-beta1/SECURITY.md","tags":["web"]},{"url":"https://github.com/apache/storm/blob/v0.10.0-beta1/STORM-UI-REST-API.md","tags":["web"]},{"url":"https://web.archive.org/web/20151014213052/http://www.securitytracker.com/id/1032695","tags":["web"]},{"url":"https://web.archive.org/web/20171202122914/http://www.securityfocus.com/archive/1/535804/100/0/threaded","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cg5h-q983-4rww"}],"sources":{"cve":[{"id":"CVE-2015-3188","description":"The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.","status":"published","published":"2017-01-13T15:00:00Z","modified":"2024-08-06T05:39:31.987Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2022-3571","description":"The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.","status":"published","published":"2017-01-13T15:00:00Z","modified":"2024-08-06T05:39:31Z","updated_at":"2026-11-03T02:22:09.179399Z"}],"ghsa":[{"id":"GHSA-cg5h-q983-4rww","title":"Apache Storm remote code execution vulnerability","description":"The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.","status":"published","published":"2022-05-14T02:48:54Z","modified":"2023-08-02T21:01:27Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:36:58.760727Z"}],"nvd":[{"id":"CVE-2015-3188","description":"The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.","status":"published","published":"2017-01-13T15:59:00.153Z","modified":"2026-06-17T00:25:30.04Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"GHSA-cg5h-q983-4rww","title":"Apache Storm remote code execution vulnerability","description":"The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.","status":"published","published":"2022-05-14T02:48:54Z","modified":"2023-11-08T03:57:53.027604Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:44.927642Z"}]}}