PT-2020-12308 · Red Hat · Infinispan

Published 2020-10-19 · Updated 2021-10-26 · CVE-2020-10746

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Infinispan version 10

Description A flaw in Infinispan permits local access to controls via both REST and HotRod APIs, allowing a user authenticated to the local machine to perform all operations on the caches, including creation, update, deletion, and shutdown of the entire server.

Recommendations For Infinispan version 10, restrict access to the REST and HotRod APIs to prevent unauthorized local access to controls, and consider implementing additional security measures to limit the actions that can be performed by locally authenticated users.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-10746

Affected Products

Infinispan

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-10746 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10746 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1835922 · Note
• https://t.me/cvenotify/14463 · Telegram Post
• https://t.me/cvenotify/14033 · Telegram Post