CVE-2015-0225
apache cassandra: no CVSS score yet. EPSS 6.6% chance of exploitation in the next 30 days. Fixed in org.apache.cassandra:apache-cassandra 2.0.14, 2.1.4.
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
- EPSS
- 6.6% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-77
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cassandra
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w7f2-gjxf-2gm9 | Maven | org.apache.cassandra:apache-cassandra | >=1.2.0 <2.0.14 | 2.0.14 |
| GHSA-w7f2-gjxf-2gm9 | Maven | org.apache.cassandra:apache-cassandra | >=2.1.0 <2.1.4 | 2.1.4 |
References
- http://packetstormsecurity.com/files/131249/Apache-Cassandra-Remote-Code-Execution.html
- http://rhn.redhat.com/errata/RHSA-2015-1947.html
- http://www.mail-archive.com/user%40cassandra.apache.org/msg41819.html
- http://www.securityfocus.com/archive/1/535154/100/0/threaded
- http://www.securityfocus.com/bid/73478