PT-2020-16169 · Red Hat · Infinispan

Published 2020-12-03 · Updated 2022-11-10 · CVE-2020-25711

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions infinispan version 10

Description A flaw was found in the infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authorization is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

Recommendations For infinispan version 10, as a temporary workaround, consider disabling the REST API or restricting access to server management operations until a patch is available. Restrict access to the shutdown operation to minimize the risk of exploitation. Avoid using the REST API for server management operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Improper Privilege Management

Weakness Enumeration

CWE-862

CWE-269

Related Identifiers

CVE-2020-25711

GHSA-8674-26JC-WH98

Affected Products

Infinispan

References · 10

• https://osv.dev/vulnerability/CVE-2020-25711 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25711 · Security Note
• https://osv.dev/vulnerability/GHSA-8674-26jc-wh98 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220210-0023 · Note
• https://t.me/cibsecurity/17116 · Telegram Post
• https://t.me/cvenotify/37463 · Telegram Post
• https://t.me/cvenotify/6531 · Telegram Post
• https://t.me/cvenotify/6532 · Telegram Post
• https://t.me/cvenotify/6706 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=1897618 · Note