CVE-2020-25711
Improper Access Control in infinispan-server-runtime
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
- Record
CVE-2020-25711- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:N/I:P/A:P - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
- Record
CVE-2020-25711- Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2022-0906 No score
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
- Record
EUVD-2022-0906- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8674-26jc-wh98
Improper Access Control in infinispan-server-runtime
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
- Record
GHSA-8674-26jc-wh98- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-269, CWE-862
- Updated
- 2026-11-02
OSV
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
- Record
CVE-2020-25711- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-8674-26jc-wh98
Improper Access Control in infinispan-server-runtime
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
- Record
GHSA-8674-26jc-wh98- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-269, CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.infinispan:infinispan-coreMaven |
through 11.0.5.Final | 11.0.6.Final |
org.infinispan:infinispan-coreMaven |
before 11.0.6.Final, plus listed versions 10.0.0.Alpha110.0.0.Alpha210.0.0.Alpha310.0.0.Beta110.0.0.Beta2 Show 45 moreShow less10.0.0.Beta310.0.0.Beta410.0.0.Beta510.0.0.CR110.0.0.CR210.0.0.CR310.0.0.Final10.0.1.Final10.1.0.Beta110.1.0.CR110.1.0.Final10.1.1.Final10.1.2.Final10.1.3.Final10.1.4.Final10.1.5.Final10.1.6.Final10.1.7.Final10.1.8.Final10.1.9.Final11.0.0.Alpha11.0.0.Alpha111.0.0.Alpha211.0.0.CR111.0.0.Dev0311.0.0.Dev0411.0.0.Dev0511.0.0.Final11.0.1.Final11.0.2.Final11.0.3.Final11.0.4.Final11.0.5.Final5.0.0.FINAL5.0.1.FINAL5.1.0.ALPHA15.1.0.ALPHA25.1.0.BETA15.1.0.BETA25.1.0.BETA35.1.0.BETA45.1.0.BETA55.1.0.CR15.1.0.CR25.1.0.CR3 |
11.0.6.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-25711 is a medium vulnerability (CVSS 6.5) in Infinispan, published December 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in org.infinispan:infinispan-core 11.0.6.Final.
References
Left out here: 213 versions. The JSON record has them.