CVE-2021-31917

Опубликовано: 21 сент. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Ссылки

https://access.redhat.com/security/cve/cve-2021-31917
Vendor Advisory
https://access.redhat.com/security/cve/cve-2021-31917
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:infinispan:infinispan-server-rest:*:*:*:*:*:*:*:*

Версия от 10.0.0 (включая) до 11.0.12 (исключая)

cpe:2.3:a:infinispan:infinispan-server-rest:*:*:*:*:*:*:*:*

Версия от 12.0.0 (включая) до 12.1.4 (исключая)

cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:data_grid:8.0.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:data_grid:8.1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:data_grid:8.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 62%

0.00431

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости