CVE-2020-25711

Description

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

EPSS Score

Exploitation Probability

0.183

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-25711 are fixed in Infinispan--core 11.0.6	Windows
Multiple Vulnerabilities are affected in Netapp Active Iq Unified Manager 2.3	Windows
Vulnerabilities CVE-2020-25644,CVE-2020-25711,CVE-2021-3536 are affected in Red Hat Data Grid 8 8.0	Windows
Vulnerabilities CVE-2020-25644,CVE-2020-25711,CVE-2021-3536,CVE-2025-23368 are affected in Red Hat Data Grid 8 8.0	Windows
Multiple Vulnerabilities are affected in Red Hat Data Grid 8 8.0	Windows
Vulnerabilities CVE-2020-25711 are fixed in Infinispan--core for Linux 11.0.6	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234