What is CVE-2021-31917?

CVE-2021-31917 is a critical-severity vulnerability in Infinispan Infinispan-server-rest, classified under Improper Authentication. CVSS score: 9.8/10. Published 2021-09-21.

How severe is CVE-2021-31917?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Infinispan Infinispan-server-rest

CVE-2021-31917

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest th…

Vulnerability class: Broken Authentication

EPSS: 0.013 (68.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Infinispan Infinispan-server-rest
Redhat Data_grid — versions 8.0.0, 8.0.1, 8.1.0
N/a Red Hat Datagrid And Infinispan — versions Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0)

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

secalert@redhat.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-31917?: CVE-2021-31917 is a critical-severity vulnerability in Infinispan Infinispan-server-rest, classified under Improper Authentication. CVSS score: 9.8/10. Published 2021-09-21.
How severe is CVE-2021-31917?: Critical severity. CVSS v3 base score is 9.8 out of 10.