CVE-2015-0225

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 1.2.0 through 1.2.19 Apache Cassandra versions 2.0.0 through 2.0.13 Apache Cassandra versions 2.1.0 through 2.1.3

Description The default configuration of Apache Cassandra binds an unauthenticated JMX/RMI interface to all network interfaces. This allows remote attackers to execute arbitrary Java code via an RMI request.

Recommendations For Apache Cassandra versions 1.2.0 through 1.2.19, restrict access to the JMX/RMI interface to minimize the risk of exploitation. For Apache Cassandra versions 2.0.0 through 2.0.13, restrict access to the JMX/RMI interface to minimize the risk of exploitation. For Apache Cassandra versions 2.1.0 through 2.1.3, restrict access to the JMX/RMI interface to minimize the risk of exploitation.