CVE-2020-25711

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-25711

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-25711.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-25711

Aliases

GHSA-8674-26jc-wh98

Published

2020-12-03T17:15:12.647Z

Modified

2026-04-10T04:25:13.275360Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

[none]

Details

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

References

Affected packages

Git / github.com/infinispan/infinispan

Affected ranges

Type

GIT

Repo

https://github.com/infinispan/infinispan

Events

Introduced

Last affected

da1c0ed591b8695af27fddb96eb3ec6d62119468

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        }
    ]
}

Affected versions

8.*

8.0.0.Final

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-25711.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "11.0.6"
            }
        ]
    }
]