EUVD-2026-77514
GHSA-xf44-6rjp-v8cm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-delivered cross-origin read requiring authenticated operator to visit attacker page; scope changed via SOP bypass; no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Authenticated Storm operator sessions are exposed to arbitrary web origin reads via three independent misconfigurations in Apache Storm Webapp 3.0.0: Logviewer CORS origin reflection combined with credentialed responses, a CORS filter initialization parameter mismatch that causes containers to silently apply permissive defaults, and unrestricted JSONP callback wrapping on all GET endpoints that bypasses the Same-Origin Policy entirely. Any malicious web page visited by an authenticated operator can silently exfiltrate cluster topology, configuration, and worker log data on the operator's behalf without requiring any additional privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions: (1) the victim must be an authenticated Storm operator with an active browser session to the affected Storm Webapp instance, (2) the victim must visit a malicious web page controlled by the attacker while that session is active (UI:R - user interaction is mandatory), and (3) the Storm UI, Logviewer, or DRPC endpoints must be reachable from the victim's browser, which is typically satisfied for operators on the same internal network as the cluster. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector was provided in the input data; severity is independently derived. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Apache Storm Webapp to version 3.1.0, which resolves all three mechanisms: the Logviewer no longer reflects request origins into credentialed CORS responses, the shared CORS filter is configured via the correct initialization parameter so container defaults are not applied, and JSONP wrapping is now controlled by the ui.enable.jsonp configuration key, which defaults to false. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Apache Storm Webapp 3.0.0 and assess how many authenticated operators access external websites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cors Misconfiguration
View allCross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` co
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today