CVE-2025-24860

Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer. Users with restricted data center access can update their own permissions via data control language (DCL) statements on affected versions. This issue affects Apache Cassandra: from 4.0.0 through 4.0.15 and from 4.1.0 through 4.1.7 for CassandraNetworkAuthorizer, and from 5.0.0 through 5.0.2 for both CassandraNetworkAuthorizer and CassandraCIDRAuthorizer. Operators using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer on affected versions should review data access rules for potential breaches. Users are recommended to upgrade to versions 4.0.16, 4.1.8, 5.0.3, which fixes the issue.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/yjo5on4tf7s1r9qklc4byrz30b8vkm2d	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/02/03/3	Mailing List Vendor Advisory
https://security.netapp.com/advisory/ntap-20250214-0005/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:cassandra::::::::
	cpe:2.3:a:apache:cassandra::::::::
	cpe:2.3:a:apache:cassandra::::::::

History

No history.

Information

Published : 2025-02-04 11:15

Updated : 2025-06-09 19:43

NVD link : CVE-2025-24860

Mitre link : CVE-2025-24860

CVE.ORG link : CVE-2025-24860

JSON object : View

Products Affected

apache

cassandra

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-24860", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2025-02-04T11:15:09.107", "references": [{"url": "https://lists.apache.org/thread/yjo5on4tf7s1r9qklc4byrz30b8vkm2d", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2025/02/03/3", "tags": ["Mailing List", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20250214-0005/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR groups they should not be able to when using CassandraNetworkAuthorizer or CassandraCIDRAuthorizer.\n\nUsers with restricted data center access can update their own permissions via data control language (DCL) statements on affected versions.\n\n\n\n\nThis issue affects Apache Cassandra: from 4.0.0 through 4.0.15 and from 4.1.0 through 4.1.7 for CassandraNetworkAuthorizer, and from 5.0.0 through 5.0.2 for both CassandraNetworkAuthorizer and CassandraCIDRAuthorizer.\n\n\n\n\nOperators using\u00a0CassandraNetworkAuthorizer or\u00a0CassandraCIDRAuthorizer on affected versions should review data access rules for potential breaches. Users are recommended to upgrade to versions 4.0.16, 4.1.8, 5.0.3, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n incorrecta en Apache Cassandra que permite a los usuarios acceder a un centro de datos o grupos de IP/CIDR a los que no deber\u00edan poder acceder cuando utilizan CassandraNetworkAuthorizer o CassandraCIDRAuthorizer. Los usuarios con acceso restringido al centro de datos pueden actualizar sus propios permisos a trav\u00e9s de instrucciones de lenguaje de control de datos (DCL) en las versiones afectadas. Este problema afecta a Apache Cassandra: de 4.0.0 a 4.0.15 y de 4.1.0 a 4.1.7 para CassandraNetworkAuthorizer, y de 5.0.0 a 5.0.2 para CassandraNetworkAuthorizer y CassandraCIDRAuthorizer. Los operadores que utilicen CassandraNetworkAuthorizer o CassandraCIDRAuthorizer en las versiones afectadas deben revisar las reglas de acceso a los datos para detectar posibles infracciones. Se recomienda a los usuarios que actualicen a las versiones 4.0.16, 4.1.8, 5.0.3, que solucionan el problema."}], "lastModified": "2025-06-09T19:43:36.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "282DA169-6FCB-4381-9B68-CAA2D415E64D", "versionEndExcluding": "4.0.16", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B436C4E3-A38B-42E4-AFF4-C057BE7E156C", "versionEndExcluding": "4.1.8", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BFBF10F-8408-495D-99E6-AE122CDD87CC", "versionEndExcluding": "5.0.3", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}