CVE-2020-25711 Improper Access Control in infinispan-server-runtime

What is CVE-2020-25711?

CVE-2020-25711 is a medium-severity missing authorization vulnerability in Netapp Active Iq Unified Manager, published on 3 Dec 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

Weakness: CWE-862

Which versions are affected by CVE-2020-25711?

2 open source packages ship an affected version, including org.infinispan:infinispan-core. It affects 3 products.

Products include Infinispan Infinispan, Netapp Active Iq Unified Manager, Redhat Data Grid.

How do I fix CVE-2020-25711?

Upgrade org.infinispan:infinispan-core to 11.0.6.Final or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-25711 being exploited?

There is no known exploitation of CVE-2020-25711 in the wild and no public exploit code.

Other vulnerabilities in Netapp Active Iq Unified Manager

• CVE-2018-1131 Deserialization of Untrusted Data in Infinispan High 8.8
• CVE-2017-15089 Deserialization of Untrusted Data in Infinispan High 8.8
• CVE-2019-10174 Use of Externally-Controlled Input to Select Classes or Code in Infinispan High 7.5
• CVE-2023-5384 Infinispan: credentials returned from configuration as clear text High 7.2
• CVE-2023-3628 Infispan: rest bulk ops don't check permissions Medium 6.5

All Netapp Active Iq Unified Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8674-26jc-wh98.