5.9

CVE-2020-13946

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Cassandra Version < 2.1.22
Apache ≫ Cassandra Version >= 2.2.0 < 2.2.18
Apache ≫ Cassandra Version >= 3.0.0 < 3.0.22
Apache ≫ Cassandra Version >= 3.11.0 < 3.11.8
Apache ≫ Cassandra Version4.0.0 Updatealpha1
Apache ≫ Cassandra Version4.0.0 Updatealpha2
Apache ≫ Cassandra Version4.0.0 Updatealpha3
Apache ≫ Cassandra Version4.0.0 Updatealpha4
Apache ≫ Cassandra Version4.0.0 Updatebeta1
Netapp ≫ Oncommand Insight Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.23% 0.457
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.