What’s Vulnerable › Vulnerabilities

CVE-2020-25711

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-03 · updated 2026-06-17
• Weakness: CWE-862

Description

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

Affected products

• Red Hat infinispan: before 11.0.6 — fixed in 11.0.6
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• RedHat Data Grid: 8.0

How to fix

Upgrade to a fixed version: Red Hat infinispan 11.0.6. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1897618
• https://security.netapp.com/advisory/ntap-20220210-0023/
• https://bugzilla.redhat.com/show_bug.cgi?id=1897618
• https://security.netapp.com/advisory/ntap-20220210-0023/

Get alerted when CVE-2020-25711 or the next vulnerability affects your stack