PT-2015-4531

CVE-2015-0225

·

Published

2015-04-03

·

Updated

2022-05-14

Description by

CVSS 2.0
7.5
High
MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 1.2.0 through 1.2.19 Apache Cassandra versions 2.0.0 through 2.0.13 Apache Cassandra versions 2.1.0 through 2.1.3
Description The default configuration of Apache Cassandra binds an unauthenticated JMX/RMI interface to all network interfaces. This allows remote attackers to execute arbitrary Java code via an RMI request.
Recommendations For Apache Cassandra versions 1.2.0 through 1.2.19, restrict access to the JMX/RMI interface to minimize the risk of exploitation. For Apache Cassandra versions 2.0.0 through 2.0.13, restrict access to the JMX/RMI interface to minimize the risk of exploitation. For Apache Cassandra versions 2.1.0 through 2.1.3, restrict access to the JMX/RMI interface to minimize the risk of exploitation.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')
Related identifiers
CVE-2015-0225
GHSA-W7F2-GJXF-2GM9
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com