CVE-2021-44521
Remote code execution for scripted UDFs
9.1
CRITICAL
CVSS 3.1
EPSS 54.9%
描述
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
如何修補 CVE-2021-44521
要修補 CVE-2021-44521,請將受影響套件升級到下列已修補版本。
- —升級至 3.0.26 或更新版本
- —升級至 3.0.26 或更新版本
CVE-2021-44521 正在被利用嗎?
可能 — EPSS 為 54.9%,屬於高被利用機率區間,建議優先修補。
受影響套件(2)
- >= 3.0.0, < 3.0.26, >= 3.11.0, < 3.11.12, >= 4.0.0, < 4.0.2
- from 0, < 3.0.26
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |