CVE Feed

    Dashboard / CVE / CVE-2018-8016

    CVE-2018-8016

    The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.

    Published:Jun 26, 2018
    Last Modified:Nov 21, 2024
    EPS:Jun 28, 2018
    EPSS Score:0.00642
    CVSS Score:9.8

    Affected Products

    Vendor
    Apache
    Product
    Cassandra

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-32588 (CVSS 6.5) — Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencie…
    CVE-2026-27315 (CVSS 5.5) — Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passw…
    CVE-2026-27314 (CVSS 8.8) — Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user…
    CVE-2025-26467 (CVSS 8.8) — Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL…
    CVE-2024-27137 (CVSS 5.3) — In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or con…
    CVE-2025-24860 (CVSS 5.4) — Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR gro…
    CVE-2025-23015 (CVSS 8.8) — Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL…
    CVE-2023-30601 (CVSS 7.8) — Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the…
    CVE-2021-44521 (CVSS 9.1) — When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scr…
    CVE-2020-17516 (CVSS 7.5) — Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High