CVE-2024-27137

Severity CVSS v4.0:
Pending analysis
Type:
CWE-287 Authentication Issues
Publication date:
04/02/2025
Last modified:
15/02/2025

Description

In Apache Cassandra it is possible for a local attacker without access<br /> to the Apache Cassandra process or configuration files to manipulate <br /> the RMI registry to perform a man-in-the-middle attack and capture user <br /> names and passwords used to access the JMX interface. The attacker can <br /> then use these credentials to access the JMX interface and perform <br /> unauthorized operations.<br /> <br /> <br /> This is same vulnerability that CVE-2020-13946 was issued for, but the Java option was changed in JDK10.<br /> <br /> <br /> This issue affects Apache Cassandra from 4.0.2 through 5.0.2 running Java 11.<br /> <br /> <br /> Operators are recommended to upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 which fixes the issue.