CVE-2024-27137 Apache Cassandra: unrestricted deserialization of JMX authentication credentials

🗓️ 04 Feb 2025 10:19:44Reported by apacheType

Local attackers may capture JMX credentials in Apache Cassandra, affecting versions 4.0.2 to 5.0.2.

Reporter	Title	Published	Views	Family All 29
BDU FSTEC	The vulnerability of the JMX distributed database system management interface of Apache Cassandra allows a attacker to execute a “man-in-the-middle” attack.	5 Feb 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the CassandraNetworkAuthorizer and CassandraCIDRAuthorizer components of the distributed Apache Cassandra database management system allows attackers to enhance their privileges.	5 Feb 202500:00	–	bdu_fstec
Chainguard	CVE-2024-27137 vulnerabilities	18 Mar 202504:12	–	cgr
Circl	CVE-2024-27137	3 Feb 202523:49	–	circl
CNNVD	Apache Cassandra 安全漏洞	4 Feb 202500:00	–	cnnvd
CVE	CVE-2024-27137	4 Feb 202510:19	–	cve
EUVD	EUVD-2025-0229	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Cassandra: unrestricted deserialization of JMX authentication credentials	4 Feb 202512:30	–	github
NVD	CVE-2024-27137	4 Feb 202511:15	–	nvd
OSV	AZL-56430 CVE-2024-27137 affecting package cassandra 5.0.0-2	4 Feb 202511:15	–	osv

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Cassandra",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.0.15",
        "status": "affected",
        "version": "4.0.2",
        "versionType": "semver"
      },
      {
        "lessThan": "4.1.8",
        "status": "affected",
        "version": "4.1.0",
        "versionType": "semver"
      },
      {
        "lessThan": "5.0.3",
        "status": "affected",
        "version": "5.0-beta1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/jsk87d9yv8r204mgqpz1qxtp5wcrpysm

04 Feb 2025 10:19Current

EPSS0.00259