Skip to content
Fencer Vulns
medium 5.9

CVE-2020-13946 json

Man-in-the-middle attack in Apache Cassandra

published 2020-09-01 6 y ago modified 2026-09-10 1 mo ago also BIT-cassandra-2020-13946 , EUVD-2021-0894 , GHSA-24ww-mc5x-xc43

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.0%
EPSS 3.0% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.

Patch / fix

  • maven org.apache.cassandra:cassandra-all 2.1.12, 2.2.18, 3.0.22, 3.11.8, 4.0-beta2
  • bitnami cassandra 2.1.22, 2.2.18, 3.0.22, 3.11.8
  • apache cassandra 2.1.22, 2.2.18, 3.0.22, 3.11.8

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-13946 updated cvss 5.9

cassandra: allows manipulation of the RMI registry to perform a MITM attack and capture user names and passwords used to access the JMX interface

  • Red Hat Fuse 7 cassandra
    affected: no fix available
  • Red Hat JBoss Operations Network 3 cassandra
    affected: no fix planned “Out of support scope”
  • Red Hat Integration - Camel K - Tech-Preview 3
    fixed: vendor fix RHSA-2021:0811

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.95% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.cassandra:cassandra-all
>=2.1.0, <2.1.12
>=2.2.0, <2.2.18
>=3.0.0, <3.0.22
>=3.11.0, <3.11.8
>=4.0-beta1, <4.0-beta2
2.1.12
2.2.18
3.0.22
3.11.8
4.0-beta2
bitnami cassandra
<2.1.22
>=2.2.0, <2.2.18
>=3.0.0, <3.0.22
>=3.11.0, <3.11.8
2.1.22
2.2.18
3.0.22
3.11.8

Affected products

  • n/a Apache Cassandra

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.