CVE-2020-13946: 
Apache Cassandra vulnerability analysis and mitigation

CVE-2020-13946 affects Apache Cassandra versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8, and 4.0-beta2. The vulnerability was discovered and disclosed in September 2020, impacting the JMX interface security of Apache Cassandra installations (NVD, MITRE).

The vulnerability allows a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack. The CVSS v3.1 base score is 5.9 (Medium) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-668 (Exposure of Resource to Wrong Sphere) (NVD).

When successfully exploited, the attacker can capture usernames and passwords used to access the JMX interface. Using these captured credentials, the attacker can then access the JMX interface and perform unauthorized operations. Additionally, when combined with CVE-2019-2684 (a JRE vulnerability), this issue can be exploited remotely (NVD).

The vulnerability requires high attack complexity but can be executed without privileges or user interaction. The attack vector is network-accessible, though initially designed for local exploitation. When combined with CVE-2019-2684, the vulnerability becomes remotely exploitable (NVD).

Users should upgrade to the fixed versions: Apache Cassandra 2.1.22, 2.2.18, 3.0.22, 3.11.8, or 4.0-beta2 or later. Products incorporating Apache Cassandra, such as NetApp OnCommand Insight, have released specific patches to address this vulnerability (NetApp Advisory).