CVE-2018-8016

CWE-306 — Missing Authentication7 documents6 sources
Severity
9.8CRITICAL
EPSS
0.6%
top 30.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache CassandraApache Software Foundation Apache Cassandra
Timeline
PublishedJun 28
Latest updateMay 13

Description

The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apac…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/cassandra3.8 — 3.11.1
▶CVEListV5apache_software_foundation/apache_cassandraApache Cassandra 3.8 to 3.11.1

🔴Vulnerability Details

3
OSV
Missing Authentication for Critical Function in Apache Cassandra↗2022-05-13
▶
GHSA
Missing Authentication for Critical Function in Apache Cassandra↗2022-05-13
▶
CVEList
CVE-2018-8016: The default configuration in Apache Cassandra 3↗2018-06-28
▶

📋Vendor Advisories

1
Red Hat
cassandra: Unauthenticated JMX/RMI interface bound to all network interfaces (Regression of CVE-2015-0225)↗2018-06-26
▶

💬Community

2
Bugzilla
CVE-2018-8016 cassandra: Unauthenticated JMX/RMI interface bound to all network interfaces (Regression of CVE-2015-0225)↗2018-06-27
▶
Bugzilla
CVE-2018-8016 cassandra: Unauthenticated JMX/RMI interface bound to all network interfaces (Regression of CVE-2015-0225) [fedora-all]↗2018-06-27
▶
CVE-2018-8016 (CRITICAL CVSS 9.8) | The default configuration in Apache | cvebase.io