CVE-2015-0225
HighSummary
The default configuration in Apache Cassandra versions 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, allowing remote attackers to execute arbitrary Java code via an RMI request.
Risk Assessment
The organization is exposed to remote attacks that could lead to unauthorized code execution, potentially resulting in data loss or system takeover.
Recommendation
It is recommended to configure Apache Cassandra to bind the JMX/RMI interface only to trusted network interfaces or to secure it with appropriate authentication mechanisms.
Other vulnerabilities in Apache Cassandra
See all- CVE-2026-32588Medium
Apache Cassandra 4.0, 4.1, and 5.0 allow an authenticated user to raise query latencies via repeated password changes (authenticated DoS over CQL). The issue is fixed in versions 4.0.20, 4.1.11, and 5.0.7.
- CVE-2026-27315Medium
Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh commands via the ~/.cassandra/cqlsh_history local file. Anyone with access to this file can read the cleartext credentials.
Original NVD description (English source)
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS