Local Privilege Escalation in Apache Cassandra Security Flaw
CVE-2024-27137
Currently unrated
Summary
A local attacker can exploit an issue in Apache Cassandra where they may manipulate the RMI registry, leading to potential man-in-the-middle attacks. This vulnerability allows the attacker to capture user credentials for the JMX interface without needing access to the Apache Cassandra process or its configuration files. Once these credentials are obtained, the attacker may gain unauthorized access to the JMX interface, enabling them to perform various operations. It is crucial for operators to upgrade to specific releases to mitigate this vulnerability.
Affected Version(s)
Apache Cassandra 4.0.2 < 4.0.15
Apache Cassandra 4.1.0 < 4.1.8
Apache Cassandra 5.0-beta1 < 5.0.3
References
Timeline
Vulnerability published
Vulnerability Reserved