Apache Cassandra: User with MODIFY permission on ALL KEYSPAC…(CVE-2025-23015)

概要

Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.

This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.

Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami cassandra

[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.31"},{"introduced":"3.1.0"},{"fixed":"3.11.18"},{"introduced":"4.0.0"},{"fixed":"4.0.16"},{"introduced":"4.1.0"},{"fixed":"4.1.8"},{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}]

参照URL

advisory lists.apache.org
advisory openwall.com
advisory openwall.com
advisory security.netapp.com
web nvd.nist.gov