QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-23015

Back to search

CVE-2025-23015

Published: Feb 4, 2025

Modified: Feb 15, 2025

PUBLISHED

Description

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.

VendorProductVersions

Apache Software Foundation

Apache Cassandra

affected
3.0.0 - <= 3.0.30
affected
3.1.0 - <= 3.11.17
affected
4.0.0 - <= 4.0.15
affected
4.1.0 - <= 4.1.7
affected
5.0.0 - <= 5.0.2

Weaknesses (CWE)

CWE-267

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now