Medium severity · published Dec 3, 2020
CVE-2020-25711
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations
6.5
CVSS
1.1%
EPSS
No
On KEV
Description
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
DG
Data Grid · Redhat
8.0 · source: NVD
IN
Infinispan · Infinispan
before 11.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-25711
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-25711
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1897618
Third Party Advisory
https://security.netapp.com/advisory/ntap-20220210-0023/
More from Infinispan
9.8
CVE-2019-10158
A flaw was found in Infinispan through version 9.4.14.Final
8.8
CVE-2019-10174
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any…
8.8
CVE-2016-0750
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events
8.8
CVE-2018-1131
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations
8.8
CVE-2017-15089
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache