CVE-2021-44521

Katalog CVE

CVSS 9.1 · Critical EPSS 57,5%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada apache cassandra. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

Rincian

Terbit di NVD

11 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

57,5% peluang dieksploitasi; lebih tinggi dari 99,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356 issue tracking · mailing list · advisory vendor
• https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execu... exploit · mitigasi · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2022/02/11/4 mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220225-0001/ advisory pihak ketiga