Authorization Check Bypass

infinispan-server-runtime is vulnerable to authorization check bypass. During some server management operations with enabled authz, the lack of checking authorization permission allows any user with authentication to perform operations, such as shutting down the server without the ADMIN role...

CVE-2020-25711

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role...

CVE-2020-25711

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role...

Authorization

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role...

PT-2020-16169 · Red Hat · Infinispan

Name of the Vulnerable Software and Affected Versions: infinispan version 10 Description: A flaw was found in the infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authorization is enabled, any user with authentication...

CVE-2020-25711

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role...

CVE-2020-25711

CVE-2020-25711 affects Infinispan 10 REST API where authorization checks are not performed for certain server-management operations. When authz is enabled, any authenticated user can perform actions such as shutting down the server without the ADMIN role, enabling an authorization-check bypass. T...

CVE-2020-25711

A flaw was found in the Infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role. The highest threat...

Red Hat Infinispan Code Execution Vulnerability

Red Hat Infinispan is a distributed caching and key-value NoSQL data storage software from Red Hat Red Hat. A security vulnerability exists in Infinispan version 10 that stems from allowing local access to the control via REST and HotRod api. An attacker could exploit the vulnerability to perform...

CVE-2020-10746

A flaw was found in Infinispan org.infinispan:infinispan-server-runtime version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion...

CVE-2020-10746

A flaw was found in Infinispan org.infinispan:infinispan-server-runtime version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion...

Design/Logic Flaw

A flaw was found in Infinispan org.infinispan:infinispan-server-runtime version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion...

CVE-2020-10746

Infinispan Server Runtime (org.infinispan:infinispan-server-runtime) version 10 is described as allowing local access to controls via REST and HotRod APIs, enabling a locally authenticated user to perform all cache operations including creation, update, deletion, and shutdown of the entire server...

CVE-2020-10746

A flaw was found in Infinispan org.infinispan:infinispan-server-runtime version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion...

CVE-2020-10746

A flaw was found in Infinispan org.infinispan:infinispan-server-runtime version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion...

Infinispan: REST and HotRod APIs unsecured locally by default

A flaw was found in Infinispan org.infinispan:infinispan-server-runtime version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion...

RHEL 6 / 7 / 8 : Red Hat JBoss Enterprise Application Platform 7.2 (RHSA-2020:3142)

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3142 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6, 7, and 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

infinispan: Unsafe deserialization of malicious object injected into data cache

It was found that the Hotrod client in Infinispan would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks...