CVE-2020-25711

MEDIUM EPSS 60.6%

Published Dec 3, 20205y ago · Modified Jun 17, 20262w ago

6.5 CVSS 3.1

Medium

Published Dec 3, 2020 5y ago

Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

CVSS Details

Base Score

6.5

Exploitability

1.2

Impact

5.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction None

Scope Unchanged

Confidentiality None

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

60.6% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 5

Vendor	Product	Version	Range
infinispan	infinispan	*	<11.0.6
redhat	data_grid	8.0	any
netapp	active_iq_unified_manager	*	any
netapp	active_iq_unified_manager	*	any
netapp	active_iq_unified_manager	*	any

References 2

bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1897618

Issue TrackingThird Party Advisory
security.netapp.com https://security.netapp.com/advisory/ntap-20220210-0023/

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.