CVE-2025-23015

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-23015
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/jmks4msbgkl65ssg69x728sv1m0hwz3s
http://www.openwall.com/lists/oss-security/2025/02/03/2
http://www.openwall.com/lists/oss-security/2025/02/11/1
https://security.netapp.com/advisory/ntap-20250214-0006/
Configurations

No configuration.

History

15 Feb 2025, 01:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250214-0006/ -

11 Feb 2025, 17:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/02/11/1 -
Summary
  • (es) Vulnerabilidad de privilegios definidos con acciones no seguras en Apache Cassandra. Un usuario con permiso MODIFY ON ALL KEYSPACES puede escalar privilegios a superusuario dentro de un clúster de Cassandra de destino mediante acciones no seguras a un recurso del sistema. Los operadores que otorgan permiso MODIFY a los datos en todos los espacios de claves en las versiones afectadas deben revisar las reglas de acceso a los datos para detectar posibles infracciones. Este problema afecta a Apache Cassandra hasta las versiones 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Se recomienda a los usuarios que actualicen a las versiones 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, que solucionan el problema.

04 Feb 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

04 Feb 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-04 10:15

Updated : 2025-02-15 01:15

NVD link : CVE-2025-23015

Mitre link : CVE-2025-23015

CVE.ORG link : CVE-2025-23015

JSON object : View

Products Affected

No product.

CWE
CWE-267

Privilege Defined With Unsafe Actions