CVE-2021-31917
published 2021-09-21CVE-2021-31917: A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.30%
66.9th percentile
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| infinispan | infinispan-server-rest | >= 10.0.0 < 11.0.12 | 11.0.12 |
| infinispan | infinispan-server-rest | >= 12.0.0 < 12.1.4 | 12.1.4 |
| redhat | data_grid | — | — |
| redhat | data_grid | — | — |
| redhat | data_grid | — | — |
| redhat | data_grid | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Authentication bypass targets all REST endpoints when DIGEST authentication method is configured in Infinispan or Red Hat DataGrid ↗
- →Affected versions: Red Hat DataGrid 8.0.0, 8.0.1, 8.1.0, 8.1.1 and Infinispan 10.0.0 through 12.0.0 — monitor for unauthenticated REST API access on these versions ↗
- ·Vulnerability is only exploitable when DIGEST is configured as the authentication method on REST endpoints; deployments using other authentication mechanisms are not affected by this specific bypass ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gwqg-r7f7-jjw4: A flaw was found in Red Hat DataGrid 8
ghsa_unreviewed·2022-05-24
CVE-2021-31917 [CRITICAL] CWE-287 GHSA-gwqg-r7f7-jjw4: A flaw was found in Red Hat DataGrid 8
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Red Hat
Infinispan: Authentication bypass on REST endpoints when using DIGEST authentication mechanism
vendor_redhat·2021-05-26·CVSS 9.8
CVE-2021-31917 [CRITICAL] CWE-287 Infinispan: Authentication bypass on REST endpoints when using DIGEST authentication mechanism
Infinispan: Authentication bypass on REST endpoints when using DIGEST authentication mechanism
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in Red Hat DataGrid and Infinispan. An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-09-21
Published