« Volver al listado

CVE-2020-17516

Estado: ModificadaAlta (7.5)—

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Cassandra

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-17516",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Apache Cassandra",
          "versions": [
            {
              "status": "affected",
              "version": "2.1.0 to 2.1.22"
            },
            {
              "status": "affected",
              "version": "2.2.0 to 2.2.19"
            },
            {
              "status": "affected",
              "version": "3.0.0 to 3.0.23"
            },
            {
              "status": "affected",
              "version": "3.11.0 to 3.11.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-02-03T17:15:13.123",
  "references": [
    {
      "url": "http://mail-archives.apache.org/mod_mbox/cassandra-user/202102.mbox/%3c6E4340A5-D7BE-4D33-9EC5-3B505A626D8D%40apache.org%3e",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r81243a412a37a22211754936a13856af07cc68a93d728c52807486e9%40%3Ccommits.cassandra.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rcb16f36cafa184dd159e94033f87d0fc274c4752d467f3a09f2ceae4%40%3Ccommits.cassandra.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/rd84bec24907617bdb72f7ec907cd7437a0fd5a8886eb55aa84dd1eb8%40%3Ccommits.cassandra.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20210521-0002/",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://mail-archives.apache.org/mod_mbox/cassandra-user/202102.mbox/%3c6E4340A5-D7BE-4D33-9EC5-3B505A626D8D%40apache.org%3e",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r81243a412a37a22211754936a13856af07cc68a93d728c52807486e9%40%3Ccommits.cassandra.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rcb16f36cafa184dd159e94033f87d0fc274c4752d467f3a09f2ceae4%40%3Ccommits.cassandra.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/rd84bec24907617bdb72f7ec907cd7437a0fd5a8886eb55aa84dd1eb8%40%3Ccommits.cassandra.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20210521-0002/",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement."
    },
    {
      "lang": "es",
      "value": "Apache Cassandra versiones 2.1.0 hasta 2.1.22, versiones 2.2.0 hasta 2.2.19, versiones 3.0.0 hasta 3.0.23 y versiones 3.11.0 hasta 3.11.9, cuando se usa la configuración internode_encryption de \"dc\" o \"rack\", permite ambas conexiones de entre nodo cifradas y no cifradas. Un nodo configurado inapropiadamente o un usuario malicioso pueden usar la conexión no cifrada a pesar de no estar en el mismo rack o dc y omitir el requisito mutuo de TLS"
    }
  ],
  "lastModified": "2026-06-17T02:59:03.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B61EDD10-0909-46EF-9CF9-4864CDA49303",
              "versionEndIncluding": "2.1.22",
              "versionStartIncluding": "2.1.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F5E166F-E5BE-436B-9A29-03C93F7921FD",
              "versionEndIncluding": "2.2.19",
              "versionStartIncluding": "2.2.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8DDE4AE-9B3A-40FE-ADBA-821B71CB939B",
              "versionEndIncluding": "3.0.23",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A98515B9-8285-4428-BE7B-292829D7D329",
              "versionEndIncluding": "3.11.9",
              "versionStartIncluding": "3.11.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}