cve.bz

CVE-2020-13946

5.9 mediumEPSS 3.0%

Medium (5.9). EPSS 3.0% chance of exploitation in the next 30 days. Fixed in org.apache.cassandra:cassandra-all 2.1.12, 2.2.18, 3.0.22.

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.

Severity

CVSS 3.1

5.9 medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE
CWE-668
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-24ww-mc5x-xc43Mavenorg.apache.cassandra:cassandra-all>=2.1.0 <2.1.122.1.12
GHSA-24ww-mc5x-xc43Mavenorg.apache.cassandra:cassandra-all>=2.2.0 <2.2.182.2.18
GHSA-24ww-mc5x-xc43Mavenorg.apache.cassandra:cassandra-all>=3.0.0 <3.0.223.0.22
GHSA-24ww-mc5x-xc43Mavenorg.apache.cassandra:cassandra-all>=3.11.0 <3.11.83.11.8
GHSA-24ww-mc5x-xc43Mavenorg.apache.cassandra:cassandra-all>=4.0-beta1 <4.0-beta24.0-beta2

References

Check your stackJSON