Read the docs
TI-2020-10922 Aliases CVE-2020-13946GHSA-24ww-mc5x-xc43

Exposure of resource to wrong sphere in Apache Cassandra

Priority LOW 32CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-668 and the CVSS impact.

Summary

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.

Why it matters now

EPSS 0.02951 87th percentileScored 2026-11-07
Fix Partial org.apache.cassandra:cassandra-all (Maven): 2.1.12, 2.2.18, 3.0.22 +2Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache CassandraAll versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2—No fix listedCNA
—org.apache.cassandra:cassandra-all (Maven)2.1.0 to before 2.1.122.1.12Patch availableGHSA-24ww-mc5x-xc43
—org.apache.cassandra:cassandra-all (Maven)2.2.0 to before 2.2.182.2.18Patch availableGHSA-24ww-mc5x-xc43
—org.apache.cassandra:cassandra-all (Maven)3.0.0 to before 3.0.223.0.22Patch availableGHSA-24ww-mc5x-xc43
—org.apache.cassandra:cassandra-all (Maven)3.11.0 to before 3.11.83.11.8Patch availableGHSA-24ww-mc5x-xc43
—org.apache.cassandra:cassandra-all (Maven)4.0-beta1 to before 4.0-beta24.0-beta2Patch availableGHSA-24ww-mc5x-xc43
  • Apache Cassandra Vendor— Affected All versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2 Fixed in — No fix listed CNA
  • org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 2.1.0 to before 2.1.12 Fixed in 2.1.12 Patch available GHSA-24ww-mc5x-xc43
  • org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 2.2.0 to before 2.2.18 Fixed in 2.2.18 Patch available GHSA-24ww-mc5x-xc43
  • org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 3.0.0 to before 3.0.22 Fixed in 3.0.22 Patch available GHSA-24ww-mc5x-xc43
  • org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 3.11.0 to before 3.11.8 Fixed in 3.11.8 Patch available GHSA-24ww-mc5x-xc43
  • org.apache.cassandra:cassandra-all (Maven) Vendor— Affected 4.0-beta1 to before 4.0-beta2 Fixed in 4.0-beta2 Patch available GHSA-24ww-mc5x-xc43

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*before 2.1.22; 2.2.0 to before 2.2.18; 3.0.0 to before 3.0.22; 3.11.0 to before 3.11.8VulnerableApache
cpe:2.3:a:apache:cassandra:4.0.0:alpha1:*:*:*:*:*:*4.0.0 alpha1VulnerableApache
cpe:2.3:a:apache:cassandra:4.0.0:alpha2:*:*:*:*:*:*4.0.0 alpha2VulnerableApache
cpe:2.3:a:apache:cassandra:4.0.0:alpha3:*:*:*:*:*:*4.0.0 alpha3VulnerableApache
cpe:2.3:a:apache:cassandra:4.0.0:alpha4:*:*:*:*:*:*4.0.0 alpha4VulnerableApache
cpe:2.3:a:apache:cassandra:4.0.0:beta1:*:*:*:*:*:*4.0.0 beta1VulnerableApache
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:* Versions before 2.1.22; 2.2.0 to before 2.2.18; 3.0.0 to before 3.0.22; 3.11.0 to before 3.11.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:cassandra:4.0.0:alpha1:*:*:*:*:*:* Versions 4.0.0 alpha1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cassandra:4.0.0:alpha2:*:*:*:*:*:* Versions 4.0.0 alpha2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cassandra:4.0.0:alpha3:*:*:*:*:*:* Versions 4.0.0 alpha3 Vulnerable ·Apache
  • cpe:2.3:a:apache:cassandra:4.0.0:alpha4:*:*:*:*:*:* Versions 4.0.0 alpha4 Vulnerable ·Apache
  • cpe:2.3:a:apache:cassandra:4.0.0:beta1:*:*:*:*:*:* Versions 4.0.0 beta1 Vulnerable ·Apache
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-24ww-mc5x-xc43 org.apache.cassandra:cassandra-all (Maven) Fixed in 2.1.12 Advisory →
  • Fix · GHSA-24ww-mc5x-xc43 org.apache.cassandra:cassandra-all (Maven) Fixed in 2.2.18 Advisory →
  • Fix · GHSA-24ww-mc5x-xc43 org.apache.cassandra:cassandra-all (Maven) Fixed in 3.0.22 Advisory →
  • Fix · GHSA-24ww-mc5x-xc43 org.apache.cassandra:cassandra-all (Maven) Fixed in 3.11.8 Advisory →
  • Fix · GHSA-24ww-mc5x-xc43 org.apache.cassandra:cassandra-all (Maven) Fixed in 4.0-beta2 Advisory →

Red Hat 1 advisory

  • RHSA-2021:0811 Released 2021-03-11 · Red Hat rating Low
    Red Hat Integration Tech-Preview 3 Camel K security update
    • Red Hat Integration - Camel K - Tech-Preview 3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix yet
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat Integration - Camel K - Tech-Preview 3Fixed RHSA-2021:0811

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13946
  2. 2026-10-03 Alias added: GHSA-24ww-mc5x-xc43

References

Advisory 3

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences