PT-2025-4767 · Apache · Apache Cassandra

Adam Pond + 3 · Publicado 2025-01-10 · Atualizado 2026-05-18 · CVE-2025-23015

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2

Description A privilege escalation issue exists in Apache Cassandra, where a user with MODIFY permission on all keyspaces can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.

Recommendations To resolve the issue, upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, or 5.0.3, which fixes the issue. Operators should review data access rules for potential breaches.

Correção

LPE

Enumeração de Fraquezas

CWE-267

Identificadores relacionados

AZL-56436

AZL-56443

BDU:2025-01582

BIT-CASSANDRA-2025-23015

CLEANSTART-2026-CI66802

CLEANSTART-2026-DD05788

CLEANSTART-2026-KM27583

CLEANSTART-2026-SP91806

CLEANSTART-2026-VH41554

CVE-2025-23015

GHSA-WMCC-9VCH-JMX4

Produtos afetados

Apache Cassandra

Referências · 265

• https://github.com/apache/cassandra · Nota
• https://github.com/apache/cassandra/commit/f33267c8fae6d71166886efc3e7ddda4114ebeef · Nota
• https://github.com/apache/cassandra/commit/6207a305ba2b0cebc3241e00a843ab5dbf86d2ed · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CI66802.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DD05788.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VH41554.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SP91806.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KM27583.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-27043 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-34454 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-4330 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-52428 · Nota
• https://osv.dev/vulnerability/ghsa-fghv-69vj-qj49 · Nota
• https://osv.dev/vulnerability/CVE-2024-12798 · Nota