PT-2026-4921

CVE-2020-36939

Published

2020-12-28

Updated

2026-10-08

Description by

CVSS 2.0

7.8

High

MetricsAV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cassandra Web version 0.5.0

Description The software contains a directory traversal issue that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files, such as /etc/passwd, and retrieve Apache Cassandra database credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2020-36939

BDU:2026-01134