CVE-2020-10746

Name of the Vulnerable Software and Affected Versions Infinispan version 10

Description A flaw in Infinispan permits local access to controls via both REST and HotRod APIs, allowing a user authenticated to the local machine to perform all operations on the caches, including creation, update, deletion, and shutdown of the entire server.

Recommendations For Infinispan version 10, restrict access to the REST and HotRod APIs to prevent unauthorized local access to controls, and consider implementing additional security measures to limit the actions that can be performed by locally authenticated users.