CVE-2020-25711
First published: Fri Nov 13 2020(Updated: )
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/Infinispan | <11.0.6 | 11.0.6 |
| Infinispan Infinispan | <11.0.6 | |
| Redhat Data Grid | =8.0 | |
| Netapp Active Iq Unified Manager Linux | ||
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Windows |
Remedy
There is currently no known mitigation for this issue.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1897618
- https://security.netapp.com/advisory/ntap-20220210-0023/
- https://issues.redhat.com/browse/JDG-4194
- https://access.redhat.com/errata/RHSA-2021:0433
- https://access.redhat.com/security/cve/cve-2020-25711
- https://www.cve.org/CVERecord?id=CVE-2020-25711 https://nvd.nist.gov/vuln/detail/CVE-2020-25711
Frequently Asked Questions
What is CVE-2020-25711?
CVE-2020-25711 is a vulnerability found in Infinispan 10 REST API where authorization permissions are not checked during certain server management operations.
What is the severity of CVE-2020-25711?
The severity of CVE-2020-25711 is medium, with a CVSS score of 6.5.
How does CVE-2020-25711 affect Infinispan?
CVE-2020-25711 allows any authenticated user to perform certain server management operations, such as shutting down the server, without the ADMIN role.
How can I fix CVE-2020-25711?
To fix CVE-2020-25711, update to Infinispan version 11.0.6 or above.
Is there any additional information available for CVE-2020-25711?
Yes, you can find more information about CVE-2020-25711 in the references provided: [link1](https://issues.redhat.com/browse/JDG-4194), [link2](https://access.redhat.com/errata/RHSA-2021:0433), [link3](https://access.redhat.com/security/cve/cve-2020-25711)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- agent/references
- agent/remedy
- agent/severity
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-25711
- agent/software-canonical-lookup
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- agent/trending
- package-manager/redhat
- vendor/infinispan
- canonical/infinispan infinispan
- vendor/redhat
- canonical/redhat data grid
- version/redhat data grid/8.0
- vendor/netapp
- canonical/netapp active iq unified manager linux
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows