{"id":"CVE-2020-10771","aliases":["EUVD-2020-3185","GHSA-84m7-cxq5-q9xc"],"status":"published","title":"A flaw was found in Infinispan version 10, where it is possible to perform various actions that...","description":"A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00445,"percentile":0.38986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2021-06-02T11:02:53Z","modified":"2026-06-17T02:48:24Z","products":[{"vendor":"infinispan","product":"infinispan-server-rest"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"red hat","product":"infinispan"},{"vendor":"redhat","product":"data_grid"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1846293","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210827-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10771"},{"url":"https://github.com/advisories/GHSA-84m7-cxq5-q9xc"}],"sources":{"cve":[{"id":"CVE-2020-10771","description":"A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.","status":"published","published":"2021-06-02T11:02:53Z","modified":"2024-08-04T11:14:14.781Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:35:48.213211Z"}],"euvd":[{"id":"EUVD-2020-3185","description":"A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.","status":"published","published":"2021-06-02T11:02:53Z","modified":"2024-08-04T11:14:14Z","updated_at":"2026-11-03T03:07:49.454544Z"}],"ghsa":[{"id":"GHSA-84m7-cxq5-q9xc","title":"A flaw was found in Infinispan version 10, where it is possible to perform various actions that...","description":"A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.","status":"published","published":"2022-05-24T22:01:38Z","modified":"2023-01-30T05:05:13Z","cwes":["CWE-352"],"updated_at":"2026-11-02T14:47:13.441339Z"}],"nvd":[{"id":"CVE-2020-10771","description":"A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.","status":"published","published":"2021-06-02T12:15:07.397Z","modified":"2026-06-17T02:48:24.757Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:06:43.288951Z"}]}}