9.8

CVE-2021-31917: infinispan infinispan-server-rest Improper Authentication

CVSS: 9.8v3.1CriticalModified
Published 21-09-2021Last modified 03-08-2024
Open JSON

Vulnerability summary

CVE-2021-31917 is a critical (CVSS 9.8) Improper Authentication vulnerability in infinispan infinispan-server-rest. EPSS estimates a 1.35% chance of exploitation in the next 30 days, higher than 70.9% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
1.35%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 21-09-2021
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS metrics

2 scores · 1 source · 2 versions

EPSS trend

Probability

1.35%

Chance of exploitation in the next 30 days

Percentile

71%

Versus all other CVEs

30-day change

0.00 pp

From 1.35% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Infinispan1 product
Redhat1 product

2 vendors · 2 products

References

1 links