CVEvulnerability
CVE-2021-44521
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-02-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 8.5 HIGH — AV:N/AC:M/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-732, CWE-94
Description
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Affected configurations
• apache cassandra (>= 3.0.0 < 3.0.26)
• apache cassandra (>= 3.11.0 < 3.11.12)
• apache cassandra (>= 4.0.0 < 4.0.2)
Related
References
- http://www.openwall.com/lists/oss-security/2022/02/11/4 Mailing List, Third Party Advisory
- https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ Exploit, Mitigation, Third Party Advisory
- https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356 Issue Tracking, Mailing List, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220225-0001/ Third Party Advisory
- http://www.openwall.com/lists/oss-security/2022/02/11/4 Mailing List, Third Party Advisory
- https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ Exploit, Mitigation, Third Party Advisory
- https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356 Issue Tracking, Mailing List, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220225-0001/ Third Party Advisory