Critical severity · published Sep 21, 2021
CVE-2021-31917
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0)
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DG
Data Grid · Redhat
8.0.0; 8.0.1; 8.1.0; 8.1.1 · source: NVD
IN
Infinispan-server-rest · Infinispan
10.0.0 before 11.0.12; 12.0.0 before 12.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-31917
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-31917
Vendor Advisory
https://access.redhat.com/security/cve/cve-2021-31917
More from Infinispan-server-rest
7.1
CVE-2020-10771
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests