CVE-2020-13946: Man-in-the-middle attack in Apache Cassandra
5.9
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.66444%
CWE
Published
5/7/2021
Updated
2/1/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.cassandra:cassandra-all | maven | >= 2.1.0, < 2.1.12 | 2.1.12 |
| org.apache.cassandra:cassandra-all | maven | >= 2.2.0, < 2.2.18 | 2.2.18 |
| org.apache.cassandra:cassandra-all | maven | >= 3.0.0, < 3.0.22 | 3.0.22 |
| org.apache.cassandra:cassandra-all | maven | >= 3.11.0, < 3.11.8 | 3.11.8 |
| org.apache.cassandra:cassandra-all | maven | = 4.0-beta1 | 4.0-beta2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability centers around insecure JMX/RMI registry configuration. Analysis focused on JMX initialization and registry setup functions:
- JmxServer.start() is the logical entry point for JMX service initialization where RMI registry creation and security settings would be configured
- DatabaseDescriptor.getJmxPort() controls critical network configuration aspects While exact patch details aren't available, the CWE-668 context and MITM attack vector indicate these functions would be modified to:
- Add SSLContext configuration
- Enforce registry binding to localhost
- Validate port assignments Medium confidence stems from matching vulnerability patterns to Cassandra's JMX implementation, though without explicit patch diffs.