CVE-2020-36939: AVALANCHE123 Cassandra Web

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files like /etc/passwd and retrieve Apache Cassandra database credentials.

Affected products

Published 2026-01-27. Last modified 2026-10-08.