CVE-2024-27137
lowpriority · track · 0EPSS 0.003 · 21 %ileDEEURUUSEPSS · scored 2026-10-27
In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorized operations. This is same vulnerability that CVE-2020-13946 was issued for, but the Java option was changed in JDK10. This issue affects Apache Cassandra from 4.0.2 through 5.0.2 running Java 11. Operators are recommended to upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 which fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.3–5.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (24)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0258Apache Cassandra: Mehrere Schwachstellen.Deutsch2025-02-03csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Cassandra ausnutzen, um Informationen offenzulegen, oder seine Rechte zu erhöhen.
- GHSA-rgfx-7p65-3ff4Apache Cassandra: unrestricted deserialization of JMX authentication credentials2025-02-04ghsa · osvUS
In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorized operations. This is same vulnerability that CVE-2020-13946 was issued for, but the Java option was changed in JDK10. This issue affects Apache Cassandra from 4.0.2 through 5.0.2 running Java 11. Operators are recommended to upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 which fixes the issue.
- BIT-cassandra-2024-27137Apache Cassandra: unrestricted deserialization of JMX authentication credentials2025-02-20vendor · osvUS
In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorized operations. This is same vulnerability that CVE-2020-13946 was issued for, but the Java option was changed in JDK10. This issue affects Apache Cassandra from 4.0.2 through 5.0.2 running Java 11. Operators are recommended to upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 which fixes the issue.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://lists.apache.org/thread/jsk87d9yv8r204mgqpz1qxtp5wcrpysmcnnvd
- https://lists.apache.org/thread/jsk87d9yv8r204mgqpz1qxtp5wcrpysmenisa_euvd
- https://lists.apache.org/thread/jsk87d9yv8r204mgqpz1qxtp5wcrpysmIssue TrackingMailing ListVendor Advisorynvd
- https://security.netapp.com/advisory/ntap-20250214-0004/Third Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan