BIT-cassandra-2023-30601

    Dashboard / Vulnerabilities / BIT-cassandra-2023-30601

    BIT-cassandra-2023-30601

    Published: 6 Mar 2024Last Modified: 8 Sept 2026

    Summary: Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

    Details: Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users. MITIGATION Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.

    References: https://lists.apache.org/thread/f74p9jdhmmp7vtrqd8lgm8bq3dhxl8vn, https://nvd.nist.gov/vuln/detail/CVE-2023-30601

    Affected packages

    Package

    Name: cassandra

    Purl: pkg:bitnami/cassandra

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 4.0.0
    Fixed -4.0.10

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-cassandra-2023-30601 | CVE-DB