HIGH✓ PATCH🇬🇧 English

CVE-2025-23015

CVSS 8.8v3.1pub. 2025-02-04upd. 2025-07-14

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Apache Cassandra

    APP
    Apache
    3.0.0 – 3.0.31 (bez)3.1 – 3.11.18 (bez)4.0.0 – 4.0.16 (bez)4.1.0 – 4.1.8 (bez)5.0.0 – 5.0.3 (bez)
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
LPE
CWE
Referencje

Powiązane podatności

CVE-2016-3427CRITICAL9.8⚠ KEVPL ✓ten sam produkt

Krytyczna podatność RCE w Oracle Java SE i JRockit — komponent JMX

CVE-2021-44521CRITICAL9.1PL ✓ten sam produkt

Apache Cassandra RCE poprzez skryptowane funkcje UDF

CVE-2018-8016CRITICAL9.8PL ✓ten sam produkt

Apache Cassandra: nieuwierzytelniony interfejs JMX/RMI umożliwia RCE

CVE-2026-27314HIGH8.8ten sam produkt

Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user...

CVE-2025-26467HIGH8.8ten sam produkt

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL...