5.9

CVE-2020-13946: apache cassandra Exposure of Resource to Wrong Sphere

CVSS: 5.9v3.1MediumModified
AliasesCGA-h63c-73r8-mwm7CGA-p77g-67v5-3pjgGHSA-24ww-mc5x-xc43
Published 01-09-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-13946 is a medium (CVSS 5.9) Exposure of Resource to Wrong Sphere vulnerability in apache cassandra. EPSS estimates a 2.95% chance of exploitation in the next 30 days, higher than 86.9% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v3.1 (NVD)
EPSS score
2.95%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-6VXV-MJ77-FMMJCGA-C2QF-HFPH-RRP7

Timeline

  1. 01-09-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

2.95%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

0.00 pp

From 2.95% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.95%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apache1 product
  • cassandra< 2.1.22 | ≥ 2.2.0, < 2.2.18 | ≥ 3.0.0, < 3.0.22 | ≥ 3.11.0, < 3.11.8 | 4.0.0:alpha1 | 4.0.0:alpha2 | 4.0.0:alpha3 | 4.0.0:alpha4 | 4.0.0:beta1
Chainguard1 product
  • cassandra-4.1All versions (No fix recorded)
Netapp1 product
Org.apache.cassandra1 product
  • cassandra-all≥ 2.1.0, < 2.1.12 | ≥ 2.2.0, < 2.2.18 | ≥ 3.0.0, < 3.0.22 | ≥ 3.11.0, < 3.11.8 | ≥ 4.0-beta1, < 4.0-beta2
Wolfi1 product
  • cassandra-4.1All versions (No fix recorded)

5 vendors · 5 products

References

10 links