CVE-2021-38294

Name of the Vulnerable Software and Affected Versions Apache Storm versions 1.x prior to 1.2.4 Apache Storm versions 2.x prior to 2.2.1

Description The issue is related to a Command Injection vulnerability in the getTopologyHistory service of Apache Storm. This vulnerability can be exploited by creating a specially crafted request to the Nimbus server, allowing remote code execution prior to authentication.

Recommendations For Apache Storm versions 1.x prior to 1.2.4, update to version 1.2.4 or later. For Apache Storm versions 2.x prior to 2.2.1, update to version 2.2.1 or later. As a temporary workaround, consider restricting access to the Nimbus server to minimize the risk of exploitation.