Missing authorization in infinispan
Priority LOW 31CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Privilege escalation
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862 and CWE-269.
Summary
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
Why it matters now
EPSS 0.0108 65th percentileScored 2026-11-07
Fix Fixed org.infinispan:infinispan-core (Maven): 11.0.6.FinalRed Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | infinispan | Infinispan 11.0.6 Final | — | No fix listed | CNA |
| — | org.infinispan:infinispan-core (Maven) | before 11.0.6.Final | 11.0.6.Final | Patch available | GHSA-8674-26jc-wh98 |
- infinispan Vendor— Affected Infinispan 11.0.6 Final Fixed in — No fix listed CNA
- org.infinispan:infinispan-core (Maven) Vendor— Affected before 11.0.6.Final Fixed in 11.0.6.Final Patch available GHSA-8674-26jc-wh98
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:* | before 11.0.6 | Vulnerable | Infinispan |
| cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:* Versions before 11.0.6 Vulnerable ·Infinispan
- cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-8674-26jc-wh98 org.infinispan:infinispan-core (Maven) Fixed in 11.0.6.Final Advisory →
Red Hat 1 advisory
- RHSA-2021:0433 Released 2021-02-08 · Red Hat rating ModerateRed Hat Data Grid 8.1.1 security update
- Red Hat Data Grid 8.1.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8.1.1 | Fixed | RHSA-2021:0433 |
Not affected: 5 products
- Red Hat Fuse 7
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Fuse Service Works 6
Timeline
- 2026-10-02 Threatist record created from CVE-2020-25711
- 2026-10-03 Alias added: GHSA-8674-26jc-wh98
References
Sources
- CVE-2020-25711 · CVE Program
- CVE-2020-25711 · NVD
- FIRST EPSS
- GHSA-8674-26jc-wh98 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-25711 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences