CVE Feed

    Dashboard / CVE / CVE-2023-30601

    CVE-2023-30601

    Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users. MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.

    Published:May 30, 2023
    Last Modified:Nov 21, 2024
    EPS:May 30, 2023
    EPSS Score:0.00018
    CVSS Score:7.8

    Affected Products

    Vendor
    Apache
    Product
    Cassandra

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-32588 (CVSS 6.5) — Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencie…
    CVE-2026-27315 (CVSS 5.5) — Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passw…
    CVE-2026-27314 (CVSS 8.8) — Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user…
    CVE-2025-26467 (CVSS 8.8) — Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL…
    CVE-2024-27137 (CVSS 5.3) — In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or con…
    CVE-2025-24860 (CVSS 5.4) — Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR gro…
    CVE-2025-23015 (CVSS 8.8) — Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL…
    CVE-2021-44521 (CVSS 9.1) — When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scr…
    CVE-2020-17516 (CVSS 7.5) — Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using …
    CVE-2020-13946 (CVSS 5.9) — In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High