CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HCVE-2020-25711
Medium (6.5). EPSS 1.1% chance of exploitation in the next 30 days. Fixed in org.infinispan:infinispan-core 11.0.6.Final.
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- infinispan:infinispan
- netapp:active_iq_unified_manager
- redhat:data_grid
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8674-26jc-wh98 | Maven | org.infinispan:infinispan-core | <11.0.6.Final | 11.0.6.Final |