PoC Index

CVE-2021-44521

CRITICAL 9.1EPSS 55.0%

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

CVSS v3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v3.1
9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v2.0
8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
EPSS
55.01% chance of exploitation in the next 30 days, 99th percentile
Nuclei
critical
Published
2022-02-11
Updated
2024-08-04

Proof-of-concept exploits (2)

Nuclei templates (1)

References

Related