CRITICAL

CVE-2021-38294

CVSS v3

9.8

CRITICAL

EPSS Score

84.6%

exploit probability

CISA KEV

No

known exploited

Exploitation

SSVC status

Description

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Technical details

Published
10/25/2021

Frequently asked questions

What is CVE-2021-38294?

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

Is CVE-2021-38294 actively exploited?

Active exploitation of CVE-2021-38294 has not been confirmed. The EPSS score is 84.6%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2021-38294?

CVE-2021-38294 has a CVSS v3 base score of 9.8 (CRITICAL severity).

Is CVE-2021-38294 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.