CVEvulnerability

CVE-2021-31917

9.8 CRITICAL Published 2021-09-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-09-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected configurations

• infinispan infinispan-server-rest (>= 10.0.0 < 11.0.12) • infinispan infinispan-server-rest (>= 12.0.0 < 12.1.4) • redhat data grid 8.0.0 • redhat data grid 8.0.1 • redhat data grid 8.1.0 • redhat data grid 8.1.1

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References