{"id":"CVE-2020-36939","revision":"efa277bd4e2d45c3a3e41de7a9bc2520","records":[{"revision":"efa277bd4e2d45c3a3e41de7a9bc2520","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2020-36939","aliases":[],"title":"Cassandra Web 0.5.0 - Remote File Read","description":"Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files like /etc/passwd and retrieve Apache Cassandra database credentials.","state":0,"publishedAt":"2026-01-27T15:23:47.357+00:00","modifiedAt":"2026-10-08T15:20:47.631+00:00","affected":[{"ecosystem":"Vendor product","name":"Cassandra Web","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"avalanche123\",\n                    \"product\": \"Cassandra Web\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:gem/cassandra-web\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://www.exploit-db.com/exploits/49362","https://github.com/avalanche123/cassandra-web","https://rubygems.org/gems/cassandra-web/versions/0.5.0","https://www.vulncheck.com/advisories/cassandra-web-remote-file-read"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2020-36939","license":"CVE Program Terms of Use","key":"cve-program:CVE-2020-36939","identifiers":["CVE-2020-36939"]},"retained":false,"historicalAffected":[]}],"coverage":[]}