Remote Code Execution (RCE)

2019-12-1208:16:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Apache cassandra is vulnerable to remote code execution. The vulnerability exists due to the use of a default JMX configuration of unauthenticated JMX/RMI interface to all network interfaces. Therefore, anyone with access to the interface is allowed to listen to the RMI and to trigger a remote execution of serialized Java.

CPENameOperatorVersion
apache cassandrale1.2.19
apache cassandrale2.1.3
apache cassandrale2.0.13
apache cassandrale1.2.19
apache cassandrale2.1.3
apache cassandrale2.0.13