What is GHSA-w7f2-gjxf-2gm9?

GHSA-w7f2-gjxf-2gm9 is a security advisory published by GitHub Security Advisories with High severity. Improper Neutralization of Special Elements used in a Command in Apache Cassandra

Which CVE IDs does GHSA-w7f2-gjxf-2gm9 cover?

GHSA-w7f2-gjxf-2gm9 covers the following CVE IDs: CVE-2015-0225. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-w7f2-gjxf-2gm9?

GHSA-w7f2-gjxf-2gm9 affects 2 products, including: maven/org.apache.cassandra:apache-cassandra:\u003e= 1.2.0, \u003c 2.0.14; maven/org.apache.cassandra:apache-cassandra:\u003e= 2.1.0, \u003c 2.1.4.

GHSA-w7f2-gjxf-2gm9High

Improper Neutralization of Special Elements used in a Command in Apache Cassandra

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2015-0225 →

📋 Description

The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.

🎯 Affected products2

maven/org.apache.cassandra:apache-cassandra:>= 1.2.0, < 2.0.14
maven/org.apache.cassandra:apache-cassandra:>= 2.1.0, < 2.1.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2015-0225
http://packetstormsecurity.com/files/131249/Apache-Cassandra-Remote-Code-Execution.html
http://rhn.redhat.com/errata/RHSA-2015-1947.html
http://www.mail-archive.com/[email protected]/msg41819.html
https://github.com/advisories/GHSA-w7f2-gjxf-2gm9