CVEvulnerability

CVE-2020-13946

5.9 MEDIUM Published 2020-09-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-09-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-668

Description

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.

Affected configurations

• apache cassandra (< 2.1.22) • apache cassandra (>= 2.2.0 < 2.2.18) • apache cassandra (>= 3.0.0 < 3.0.22) • apache cassandra (>= 3.11.0 < 3.11.8) • apache cassandra 4.0.0 • netapp oncommand insight

Related

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References