BIT-cassandra-2021-44521
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/cassandra/BIT-cassandra-2021-44521.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-cassandra-2021-44521
- Aliases
-
- CVE-2021-44521
- GHSA-8ffc-79xg-29w8
- Published
- 2024-03-06T10:50:58.097Z
- Modified
- 2025-04-03T14:40:37.652Z
- Summary
- [none]
- Details
-
When running Apache Cassandra with the following configuration: enableuserdefinedfunctions: true enablescripteduserdefinedfunctions: true enableuserdefinedfunctions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
- Database specific
{ "cpes": [ "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*" ], "severity": "Critical" }- References
-
- http://www.openwall.com/lists/oss-security/2022/02/11/4
- https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/
- https://lists.apache.org/thread/y4nb9s4co34j8hdfmrshyl09lokm7356
- https://security.netapp.com/advisory/ntap-20220225-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2021-44521
Affected packages
Bitnami / cassandra
Package
- Name
- cassandra
- Purl
- pkg:bitnami/cassandra
Severity
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator