CVE-2023-3628: Infispan: rest bulk ops don't check permissions
First published: Tue Jun 27 2023(Updated: )
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Jboss Data Grid | ||
| Redhat Jboss Enterprise Application Platform | =6 | |
| Redhat Data Grid | <8.4.4 | |
| Infinispan Infinispan | ||
| maven/org.infinispan:infinispan-server-rest | <14.0.18.Final | 14.0.18.Final |
| maven/org.infinispan:infinispan-server-rest | >=15.0.0.Dev01<15.0.0.Dev04 | 15.0.0.Dev04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2023:5396
- https://bugzilla.redhat.com/show_bug.cgi?id=2217924
- https://access.redhat.com/security/cve/CVE-2023-3628
- https://nvd.nist.gov/vuln/detail/CVE-2023-3628
- https://security.netapp.com/advisory/ntap-20240125-0004
- https://github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263
- https://github.com/infinispan/infinispan/commit/b34488dcab8bdd4258972568b8405ee7111276ec
- https://github.com/advisories/GHSA-fhr7-8jx4-r9cp (Advisory)
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-3628
- agent/severity
- agent/weakness
- agent/description
- agent/title
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-fhr7-8jx4-r9cp
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- agent/author
- agent/tags
- collector/github-advisory
- vendor/redhat
- canonical/redhat jboss data grid
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/6
- canonical/redhat data grid
- vendor/infinispan
- canonical/infinispan infinispan
- package-manager/maven