CVE-2023-3628: Infispan: rest bulk ops don't check permissions
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Other sources
The REST bulk read endpoints: /rest/v2/caches/{cacheName}?action=keys /rest/v2/caches/{cacheName}?action=entries use the cluster publisher, which is an internal component which doesn't check that the subject has bulk read permissions The methods require authentication, but once authenticated, any user can invoke them successfully.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3628?
CVE-2023-3628 has been classified as a moderate severity vulnerability due to potential unauthorized information access.
How do I fix CVE-2023-3628?
To remediate CVE-2023-3628, update Infinispan to version 14.0.18.Final or 15.0.0.Dev04 or later.
What software is affected by CVE-2023-3628?
CVE-2023-3628 affects several versions of Infinispan, Red Hat JBoss Data Grid, and Red Hat JBoss Enterprise Application Platform.
Can CVE-2023-3628 be exploited remotely?
CVE-2023-3628 is not typically remotely exploitable, as it requires authenticated access to the REST bulk read endpoints.
What type of vulnerability is CVE-2023-3628?
CVE-2023-3628 is an authorization flaw that allows authenticated users to access data beyond their permitted scope.