Non notée
CVE-2025-23015 Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra
Description
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Cassandra 5.0 | 5.0.0 → 5.0.2 | Pas de correctif indiqué |
| Apache Cassandra 4.1 | 4.1.0 → 4.1.7 | Pas de correctif indiqué |
| Apache Cassandra 4.0 | 4.0.0 → 4.0.15 | Pas de correctif indiqué |
| Apache Cassandra 3.1 | 3.1.0 → 3.11.17 | Pas de correctif indiqué |
| Apache Cassandra 3.0 | 3.0.0 → 3.0.30 | Pas de correctif indiqué |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Cassandra
Les 10 CVE de Apache Cassandra →
CVE-2026-32588
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via…
Non notée
CVE-2026-27315
Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from…
Non notée
CVE-2026-27314
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with only…
Non notée
CVE-2025-26467
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra
Non notée