{"id":"CVE-2018-8016","aliases":["EUVD-2022-2477","GHSA-52gq-7j6c-xw6x"],"status":"published","title":"Missing Authentication for Critical Function in Apache Cassandra","description":"The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0227,"percentile":0.83176,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2018-06-28T16:00:00Z","modified":"2026-10-24T10:30:37Z","fixes":[{"ecosystem":"Maven","package":"org.apache.cassandra:cassandra-all","fixed_in":["3.11.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cassandra:cassandra-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8"},{"last_affected":"3.11.1"},{"fixed":"3.11.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cassandra:cassandra-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8"},{"fixed":"3.11.2"}]}],"versions":["3.10","3.11.0","3.11.1","3.8","3.9"]}],"products":[{"vendor":"apache","product":"cassandra"},{"vendor":"apache software foundation","product":"apache cassandra"}],"references":[{"url":"https://lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066%40%3Cuser.cassandra.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8016","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/bafb9060bbdf958a1c15ba66c68531116fba4a83858a2796254da066@%3Cuser.cassandra.apache.org%3E","tags":["web"]},{"url":"https://github.com/beobal/cassandra/commit/28ee665b3c0c9238b61a871064f024d54cddcc79","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/CASSANDRA-14173","tags":["web"]},{"url":"https://github.com/advisories/GHSA-52gq-7j6c-xw6x"}],"sources":{"cve":[{"id":"CVE-2018-8016","description":"The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.","status":"published","published":"2018-06-28T16:00:00Z","modified":"2024-09-16T18:34:08.513Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2022-2477","description":"The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.","status":"published","published":"2018-06-28T16:00:00Z","modified":"2024-09-16T18:34:08Z","updated_at":"2026-11-03T00:55:31.571078Z"}],"ghsa":[{"id":"GHSA-52gq-7j6c-xw6x","title":"Missing Authentication for Critical Function in Apache Cassandra","description":"The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.","status":"published","published":"2022-05-13T01:53:28Z","modified":"2024-03-04T23:14:47Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:37:39.730152Z"}],"nvd":[{"id":"CVE-2018-8016","description":"The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.","status":"published","published":"2018-06-28T16:29:00.217Z","modified":"2026-06-17T02:04:05.933Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:04:30.900603Z"}],"osv":[{"id":"CVE-2018-8016","description":"The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.","status":"published","published":"2018-06-28T16:29:00.217Z","modified":"2026-10-24T10:30:37.050093355Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"GHSA-52gq-7j6c-xw6x","title":"Missing Authentication for Critical Function in Apache Cassandra","description":"The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.","status":"published","published":"2022-05-13T01:53:28Z","modified":"2024-03-04T23:31:01.520611Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}