GitHub Advisoryadvisory · Maven

GHSA-8674-26jc-wh98 Improper Access Control in infinispan-server-runtime

MEDIUM Published 2022-02-09 Modified 2022-02-09 Official page ↗
Aliases
CVE-2020-25711
Ecosystem
Maven
Packages
org.infinispan:infinispan-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-269, CWE-862
Reviewed
2021-04-09

Affected packages

• Maven org.infinispan:infinispan-core: < 11.0.6.Final → fixed in 11.0.6.Final

Description

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

Related

Alias · CVE (1)

  • CVE-2020-25711 A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management… vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-862 Missing Authorization weakness

References