#VU13826 Improper input validation in Cassandra - CVE-2018-8016
Published: July 12, 2018 / Updated: July 12, 2018
Vulnerability identifier: #VU13826
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2018-8016
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Cassandra
Cassandra
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote attacker to execute arbitrary Java code on the target system.
The vulnerability exists due to improper binding of an unauthenticated Java Management Extensions (JMX)/Remote Method Invocation (RMI) interface to all network interfaces. A remote unauthenticated attacker can access the JMX/RMI interface via Java APIs, load a specially crafted file that submits malicious input and execute arbitrary Java code on the system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Update to version 3.11.2 or 4.0.