CVE-2020-25711

Published: Dec 3, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.2 / Impact: 5.2

Source: NVD

Description

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

Affected (5)

Products: Infinispan: Infinispan · Redhat: Data Grid · Netapp: Active Iq Unified Manager

1 product

1 product

1 product

Active Iq Unified Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Infinispan Infinispan	Before 11.0.6

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Data Grid	Version 8.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=1897618

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://security.netapp.com/advisory/ntap-20220210-0023/

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1897618

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://security.netapp.com/advisory/ntap-20220210-0023/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.