CVE-2015-0225
Improper Neutralization of Special Elements used in a Command in Apache Cassandra
CVE-2015-0225 is a high vulnerability (CVSS 7.5) in Apache Cassandra, published April 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.64%, the 93rd percentile. Fixed in org.apache.cassandra:apache-cassandra 2.0.14.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 6.64%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.14org.apache.cassandra:apache-cassandra +3 more
Description
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cassandra:apache-cassandraMaven | 1.2.0 up to 2.0.14 | 2.0.14 |
org.apache.cassandra:apache-cassandraMaven | 2.1.0 up to 2.1.4 | 2.1.4 |
org.apache.cassandra:apache-cassandraMaven | 1.2.0 up to 2.0.14, plus listed versions 1.2.11.2.101.2.111.2.121.2.13 Show 32 moreShow less1.2.141.2.151.2.161.2.171.2.181.2.191.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.0.02.0.0-beta12.0.0-beta22.0.0-rc12.0.0-rc22.0.12.0.102.0.112.0.122.0.132.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.9 | 2.0.14 |
org.apache.cassandra:apache-cassandraMaven | 2.1.0 up to 2.1.4, plus listed versions 2.1.12.1.22.1.3 | 2.1.4 |
What each source reports
NVD Score used
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
- Record
CVE-2015-0225- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE ListNo score
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
- Record
CVE-2015-0225- Updated
- 2026-11-02
EUVDEUVD-2022-5523No score
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
- Record
EUVD-2022-5523- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w7f2-gjxf-2gm9No score
Improper Neutralization of Special Elements used in a Command in Apache Cassandra
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
- Record
GHSA-w7f2-gjxf-2gm9- Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-w7f2-gjxf-2gm9No score
Improper Neutralization of Special Elements used in a Command in Apache Cassandra
The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
- Record
GHSA-w7f2-gjxf-2gm9- Weakness
- CWE-77
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
mail-archive.com/user%40cassandra.apache.org/msg41819.html
rhn.redhat.com/errata/RHSA-2015-1947.html
securityfocus.com/bid/73478
packetstormsecurity.com/files/131249/Apache-Cassandra-Remote-Code-Execution.html
securitytracker.com/id/1034002
nvd.nist.gov/vuln/detail/CVE-2015-0225
github.com/advisories/GHSA-w7f2-gjxf-2gm9