Medium severity6.5NVD Advisory· Published Dec 3, 2020· Updated Jun 17, 2026
CVE-2020-25711
CVE-2020-25711
Description
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.infinispan:infinispan-coreMaven | < 11.0.6.Final | 11.0.6.Final |
Affected products
7Infinispan 11.0.6 Final+ 1 more
- (no CPE)range: Infinispan 11.0.6 Final
- cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*range: <11.0.6
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*+ 2 more
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
Patches
Vulnerability mechanics
References
5- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-8674-26jc-wh98ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-25711ghsaADVISORY
- security.netapp.com/advisory/ntap-20220210-0023/nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20220210-0023ghsaWEB
News mentions
0No linked articles in our index yet.