CVE-2020-25711

moderate-risk

Published 2020-12-03

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

Do I need to act?

0.18% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (5)

Infinispan

Data Grid

Active Iq Unified Manager

Affected Vendors

Redhat Netapp Infinispan

References (4)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1897618

Third Party Advisory https://security.netapp.com/advisory/ntap-20220210-0023/

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1897618

Third Party Advisory https://security.netapp.com/advisory/ntap-20220210-0023/

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 12/34 · Low