Improper input validation in Cassandra - CVE-2018-8016
Published: July 12, 2018 / Updated: July 12, 2018
Vulnerability identifier: #VU13826
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-8016
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary Java code on the target system.
The vulnerability exists due to improper binding of an unauthenticated Java Management Extensions (JMX)/Remote Method Invocation (RMI) interface to all network interfaces. A remote unauthenticated attacker can access the JMX/RMI interface via Java APIs, load a specially crafted file that submits malicious input and execute arbitrary Java code on the system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Cassandra
How to mitigate CVE-2018-8016
Update to version 3.11.2 or 4.0.
Cassandra - addressed in versions 3.11.2, 4.0