PT-2025-2395 · Apache+1 · Apache Cassandra+1

Paulo Motta · Published 2024-02-20 · Updated 2026-05-18 · CVE-2024-27137

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Cassandra versions 4.0.2 through 5.0.2

Description A local attacker without access to the Apache Cassandra process or configuration files can manipulate the RMI registry to perform a man-in-the-middle attack. This allows the attacker to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorized operations.

Recommendations Apache Cassandra versions 4.0.2 through 5.0.2: Upgrade to a release equal to or later than 4.0.15, 4.1.8, or 5.0.3 to fix the issue.

Fix

Improper Authentication

Deserialization of Untrusted Data

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-287

CWE-502

CWE-668

Related Identifiers

AZL-56430

AZL-56446

BDU:2025-01150

BIT-CASSANDRA-2024-27137

CLEANSTART-2026-CI66802

CLEANSTART-2026-DD05788

CLEANSTART-2026-KM27583

CLEANSTART-2026-SP91806

CLEANSTART-2026-VH41554

CVE-2024-27137

GHSA-RGFX-7P65-3FF4

Affected Products

Apache Cassandra

Red Os

References · 263

• https://nvd.nist.gov/vuln/detail/CVE-2023-27043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34454 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-43642 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://osv.dev/vulnerability/GHSA-rgfx-7p65-3ff4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-12801 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34455 · Security Note
• https://lists.apache.org/thread/jsk87d9yv8r204mgqpz1qxtp5wcrpysm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42587 · Security Note