Arbitrary Code Execution Affecting org.apache.cassandra:cassandra-all package, versions [3.8,3.11.2)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHECASSANDRA-32397
- published 28 Jun 2018
- disclosed 28 Jun 2018
- credit Unknown
Introduced: 28 Jun 2018
CVE-2018-8016 Open this link in a new tabOverview
org.apache.cassandra:cassandra-all is a free and open-source distributed wide column store NoSQL database management system designed to handle large amounts of data across many commodity servers.
Affected versions of this package are vulnerable to Arbitrary Code Execution.
The default configuration would bind an unauthenticated JMX/RMI
interface to all network interfaces, which allowed remote attackers to execute arbitrary Java code via an RMI
request.
Note: This issue is a regression of CVE-2015-0225.
References
Upgrade org.apache.cassandra:cassandra-all
to version 3.11.2 or higher.