Vulnerability Details : CVE-2015-0225
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
Products affected by CVE-2015-0225
- cpe:2.3:a:apache:cassandra:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.17:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.18:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.19:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.15:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:1.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:apache:cassandra:2.0.12:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-0225
0.79%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 82 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-0225
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2015-0225
-
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-0225
-
http://rhn.redhat.com/errata/RHSA-2015-1947.html
RHSA-2015:1947 - Security Advisory - Red Hat Customer Portal
-
http://www.mail-archive.com/user@cassandra.apache.org/msg41819.html
[SECURITY ANNOUNCEMENT] CVE-2015-0225
-
http://www.securitytracker.com/id/1034002
JBoss Operations Network Cassandra JMX/RMI Interface Lets Remote Users Execute Arbitrary Code on the Target System - SecurityTracker
-
http://www.securityfocus.com/bid/73478
Apache Cassandra CVE-2015-0225 Remote Code Execution Vulnerability
-
http://www.securityfocus.com/archive/1/535154/100/0/threaded
SecurityFocus
-
http://packetstormsecurity.com/files/131249/Apache-Cassandra-Remote-Code-Execution.html
Apache Cassandra Remote Code Execution ≈ Packet Storm
Jump to