Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2023-30601

Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users. MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Cassandra

Default version status: unaffected

  • 4.0.0 to ≤ 4.0.9affected
  • 4.1.0 to ≤ 4.1.1affected

References