CVE-2015-3188: Apache Storm remote code execution vulnerability
Summary
CVE-2015-3188: Apache Storm remote code execution vulnerability. Affects org.apache.storm:storm versions >= 0.10.0-beta, < 0.10.0-beta1. Fixed in 0.10.0-beta1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Storm is an open-source distributed real-time computation system. It provides a framework for processing streaming data in real-time, enabling users to build scalable and fault-tolerant applications. The UI daemon in Apache Storm 0.10.0-beta is vulnerable to remote code execution, allowing remote users to run arbitrary code as the user running the web server. This vulnerability poses a significant risk, especially when combined with kerberos authentication, as it could lead to impersonation of arbitrary users on other systems, including HDFS and HBase.
Vulnerability Detail
The vulnerability (CVE-2015-3188) in Apache Storm 0.10.0-beta allows remote users to execute arbitrary code on the target system. By exploiting this vulnerability, an attacker can run code with the privileges of the user running the web server. This can lead to unauthorized access, data manipulation, and potential compromise of other systems connected to the Apache Storm instance. The vulnerability is critical, with a CVSS score of 9.8.
How To Fix
Latest published version: 3.1.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.10.0-beta1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Apache Storm.
Conclusion
The Apache Storm remote code execution vulnerability (CVE-2015-3188) poses a significant risk to systems running Apache Storm 0.10.0-beta. It allows remote users to execute arbitrary code with the privileges of the web server user, potentially leading to unauthorized access and compromise of connected systems. To mitigate this risk, it is crucial to upgrade to Apache Storm 0.10.0-beta1 or a later version. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.storm:storm →
FAQ
Apache Storm is an open-source distributed real-time computation system used for processing streaming data in real-time.
The vulnerability allows remote code execution, enabling attackers to run arbitrary code with the privileges of the user running the web server. This can lead to unauthorized access, data manipulation, and potential compromise of other systems connected to the Apache Storm instance.
To fix this vulnerability, upgrade to Apache Storm 0.10.0-beta1 or a later version.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a patched version of Apache Storm.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.storm:storm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
