{"id":"CVE-2020-36939","aliases":["GHSA-8mfv-xhp5-48q9"],"title":"Cassandra Web - Remote File Read","summary":"Cassandra Web - Remote File Read","severity":"high","cvss":7.5,"cwe":["CWE-22"],"vendor":"cassandra-web","product":"cassandra-web","ecosystem":"rubygems","affected":["cassandra-web <= 0.5.0"],"published":"2026-01-27","updated":"2026-09-08","sourceUpdated":"2026-09-08T18:17:11Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-8mfv-xhp5-48q9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36939"},{"url":"https://rubygems.org/gems/cassandra-web/versions/0.5.0"},{"url":"https://www.exploit-db.com/exploits/49362"},{"url":"https://www.vulncheck.com/advisories/cassandra-web-remote-file-read"},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cassandra-web/CVE-2020-36939.yml"},{"url":"https://github.com/advisories/GHSA-8mfv-xhp5-48q9"}],"tags":["ghsa","rubygems","exploit-available"],"epss":0.0291,"epssPercentile":0.86419,"exploits":{"metasploit":["auxiliary/scanner/http/cassandra_web_file_read"],"checkedAt":"2026-09-25T08:20:47.089Z"},"exploitAvailable":true,"ingestedAt":"2026-09-08T19:08:49.635Z","slug":"CVE-2020-36939","body":"## Overview\n\nCassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files like /etc/passwd and retrieve Apache Cassandra database credentials.\n\n## Affected packages\n\n- `cassandra-web <= 0.5.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.6,"exploitation":12,"ransomware":0},"changes":[]}