CVE-2015-0225

Apache Cassandra 1.2.0-1.2.19, 2.0.0-2.0.13, 2.1.0-2.1.3 - Unauthenticated Remote Code Execution via JMX/RMI Interface

Title source: llm
STIX 2.1

Description

The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.

References (6)

Core 6
Core References
Mailing List mailing-list x_refsource_mlist
http://www.mail-archive.com/user%40cassandra.apache.org/msg41819.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-1947.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/73478
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/535154/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034002

Scores

EPSS 0.0067
EPSS Percentile 71.6%

Details

CWE
CWE-77
Status published
Products (39)
apache/cassandra 1.2.0
apache/cassandra 1.2.1
apache/cassandra 1.2.2
apache/cassandra 1.2.3
apache/cassandra 1.2.4
apache/cassandra 1.2.5
apache/cassandra 1.2.6
apache/cassandra 1.2.7
apache/cassandra 1.2.8
apache/cassandra 1.2.9
... and 29 more
Published Apr 03, 2015
Tracked Since Feb 18, 2026