CVE-2025-23015

Katalog CVE

CVSS 8.8 · High EPSS 1,0%

Kerentanan Privilege Defined With Unsafe Actions pada apache cassandra. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.

Rincian

Terbit di NVD

4 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-267: Privilege Defined With Unsafe Actions

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 61,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/jmks4msbgkl65ssg69x728sv1m0hwz3s issue tracking · mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/02/03/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/02/11/1 mailing list · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20250214-0006/ advisory pihak ketiga