PatchTheCVEstackstorm vulnerabilities
Recent CVEs affecting stackstorm products. 4 tracked.
stackstorm has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2022-12-06. Highest priority: CVE-2021-44657 (score 57/100).
- CVE-2022-44009 HIGH 7.5 DOWNGRADE Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja fi
- CVE-2022-43706 MEDIUM 5.4 UPGRADE Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in
- CVE-2021-44657 HIGH 8.8 UPGRADE In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execu
- CVE-2021-28667 HIGH 7.5 UPGRADE StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk
FAQ
How do I fix stackstorm vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is stackstorm being exploited right now?
None of the tracked stackstorm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which stackstorm CVE should I patch first?
CVE-2021-44657 currently ranks highest (57/100): In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execu.