Log in Start free

Vulnerability · Published Sep 1, 2020 · Assigned by apache

CVE-2020-13946

Medium 5.9

In plain English

A medium-severity security flaw in Apache Cassandra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)3.0%top 12.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.cassandra:cassandra-all2.1.12GHSA-24ww-mc5x-xc43
Mavenorg.apache.cassandra:cassandra-all2.2.18GHSA-24ww-mc5x-xc43
Mavenorg.apache.cassandra:cassandra-all3.0.22GHSA-24ww-mc5x-xc43
Mavenorg.apache.cassandra:cassandra-all3.11.8GHSA-24ww-mc5x-xc43
Mavenorg.apache.cassandra:cassandra-all4.0-beta2GHSA-24ww-mc5x-xc43

Affected products (as reported)

VendorProductVersions
n/a Apache Cassandra All versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2

References