Description
Systems running the Instaclustr
fork of Stratio's Cassandra-Lucene-Index plugin versions 4.0-rc1-1.0.0
through 4.0.16-1.0.0 and 4.1.2-1.0.0 through 4.1.8-1.0.0, installed into
Apache Cassandra version 4.x, are susceptible to a vulnerability which
when successfully exploited could allow authenticated Cassandra users to
remotely bypass RBAC and escalate their privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NetApp | Instaclustr fork of Stratio's Cassandra-Lucene-Index plugin | 4.0-rc1-1.0.0 – ≤ 4.0.16-1.0.0, 4.1.2-1.0.0 – ≤ 4.1.8-1.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.instaclustr:cassandra-lucene-index-plugin | >= 4.0-rc1-1.0.0, < 4.0.17-1.0.0 | 4.0.17-1.0.0 | GHSA-mrqp-q7vx-v2cx |
| Maven | com.instaclustr:cassandra-lucene-index-plugin | >= 4.1.0-1.0.0, < 4.1.8-1.0.1 | 4.1.8-1.0.1 | GHSA-mrqp-q7vx-v2cx |