Local Privilege Escalation in Apache Cassandra Security Flaw
CVE-2024-27137

Currently unrated

Key Information:

Vendor
Apache
Vendor
CVE Published:
4 February 2025

Summary

A local attacker can exploit an issue in Apache Cassandra where they may manipulate the RMI registry, leading to potential man-in-the-middle attacks. This vulnerability allows the attacker to capture user credentials for the JMX interface without needing access to the Apache Cassandra process or its configuration files. Once these credentials are obtained, the attacker may gain unauthorized access to the JMX interface, enabling them to perform various operations. It is crucial for operators to upgrade to specific releases to mitigate this vulnerability.

Affected Version(s)

Apache Cassandra 4.0.2 < 4.0.15

Apache Cassandra 4.1.0 < 4.1.8

Apache Cassandra 5.0-beta1 < 5.0.3

References

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.