In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
07 Nov 2023, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
03 Dec 2022, 14:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20210521-0005/ - Third Party Advisory | |
| References | (MLIST) https://lists.apache.org/thread.html/rab8d90d28f944d84e4d7852f355a25c89451ae02c2decc4d355a9cfc@%3Cuser.cassandra.apache.org%3E - Mailing List, Vendor Advisory | |
| CPE | cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | |
| First Time |
Netapp
Netapp oncommand Insight |
21 May 2021, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2020-09-01 21:15
Updated : 2023-12-10 13:27
NVD link : CVE-2020-13946
Mitre link : CVE-2020-13946
CVE.ORG link : CVE-2020-13946
JSON object : View
Products Affected
netapp
- oncommand_insight
apache
- cassandra
CWE
CWE-668
Exposure of Resource to Wrong Sphere