CVE-2015-0225 Improper Neutralization of Special Elements used in a Command in Apache Cassandra

What is CVE-2015-0225?

CVE-2015-0225 is a high-severity vulnerability in n/a, published on 3 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.

Weakness: CWE-77

Which versions are affected by CVE-2015-0225?

4 open source packages ship an affected version, including org.apache.cassandra:apache-cassandra. It affects 1 product.

Products include Apache Cassandra.

How do I fix CVE-2015-0225?

Upgrade org.apache.cassandra:apache-cassandra to a fixed version for your release line: 2.0.14 or 2.1.4.

Is CVE-2015-0225 being exploited?

There is no known exploitation of CVE-2015-0225 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2016-3427 Oracle Java SE and JRockit Unspecified Exploited Critical 9.8
• CVE-2018-8016 Missing Authentication for Critical Function in Apache Cassandra Critical 9.8
• CVE-2021-44521 Remote code execution for scripted UDFs Critical 9.1
• CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass High 8.8
• CVE-2025-26467 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only) High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w7f2-gjxf-2gm9.