-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure JMX/RMI configuration in Java 11 environments. The CassandraDaemon.setupJMX function is central to JMX initialization, and improper security settings here (or in startup scripts like cassandra-env.sh) would allow MITM attacks on the RMI registry. The CVE-2020-13946 precedent shows similar JMX misconfigurations, and the JDK10+ changes to RMI registry handling (e.g., removal of 'com.sun.management.jmxremote.rmi.port' fallback) likely exacerbated the issue. Patches in newer versions (4.0.15+, 4.1.8+, 5.0.3+) likely enforce SSL and authentication parameters in these components.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.cassandra:cassandra-all | maven | >= 5.0-beta1, < 5.0.3 | 5.0.3 |
| org.apache.cassandra:cassandra-all | maven | >= 4.1.0, < 4.1.8 | 4.1.8 |
| org.apache.cassandra:cassandra-all | maven | >= 4.0.2, < 4.0.15 | 4.0.15 |
JavaJavaOngoing coverage of React2Shell