CVE-2021-44521 is a vulnerability in Apache Cassandra
Published on February 11, 2022
Remote code execution for scripted UDFs
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2021-44521 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2021-44521
Want to know whenever a new CVE is published for Apache Cassandra? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Cassandra:- Version 3.0.0 and below unspecified is affected.
- Version unspecified and below 3.0.26 is affected.
- Version 3.1 and below unspecified is affected.
- Version unspecified and below 3.11.12 is affected.
- Version 4.0.0 and below unspecified is affected.
- Version unspecified and below 4.0.2 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.