MEDIUM 6.5 Maven
Improper Access Control in infinispan-server-runtime
GHSA-8674-26jc-wh98 · CVE-2020-25711
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
Ready to move
Start Securing
Free, no credit card | First findings in minutes