What is GHSA-8674-26jc-wh98?

GHSA-8674-26jc-wh98 is a security advisory published by GitHub Security Advisories with Medium severity. Improper Access Control in infinispan-server-runtime

Which CVE IDs does GHSA-8674-26jc-wh98 cover?

GHSA-8674-26jc-wh98 covers the following CVE IDs: CVE-2020-25711. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8674-26jc-wh98?

GHSA-8674-26jc-wh98 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-8674-26jc-wh98?

GHSA-8674-26jc-wh98 affects 1 product, including: maven/org.infinispan:infinispan-core:\u003c= 11.0.5.Final.

GHSA-8674-26jc-wh98MediumCVSS 6.5

Improper Access Control in infinispan-server-runtime

Vendor

GitHub Security Advisories

Published

February 9, 2022

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-25711 →

📋 Description

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

🎯 Affected products1

maven/org.infinispan:infinispan-core:<= 11.0.5.Final

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-25711
https://bugzilla.redhat.com/show_bug.cgi?id=1897618
https://security.netapp.com/advisory/ntap-20220210-0023/
https://github.com/advisories/GHSA-8674-26jc-wh98