CVE-2023-3629: Infinispan: non-admins should not be able to get cache config via rest api
First published: Tue Jun 27 2023(Updated: )
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Data Grid | <8.4.4 | |
| Redhat Jboss Data Grid | ||
| Redhat Jboss Enterprise Application Platform | =6 | |
| Infinispan Infinispan | ||
| maven/org.infinispan:infinispan-server-rest | <14.0.18.Final | 14.0.18.Final |
| maven/org.infinispan:infinispan-server-rest | >=15.0.0.Dev01<15.0.0.Dev04 | 15.0.0.Dev04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2023:5396
- https://bugzilla.redhat.com/show_bug.cgi?id=2217926
- https://access.redhat.com/security/cve/CVE-2023-3629
- https://nvd.nist.gov/vuln/detail/CVE-2023-3629
- https://security.netapp.com/advisory/ntap-20240125-0004
- https://github.com/infinispan/infinispan/commit/11b3cb0f7ba68b73dd32f655ff3f3df842a0c6bd
- https://github.com/infinispan/infinispan/commit/1e3cc542336d2f49743ab8176ed6f1175e034c59
- https://github.com/advisories/GHSA-r4w2-hjmr-36m7 (Advisory)
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-3629
- agent/weakness
- agent/description
- agent/title
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r4w2-hjmr-36m7
- agent/last-modified-date
- agent/severity
- agent/references
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- agent/author
- agent/tags
- collector/github-advisory
- vendor/redhat
- canonical/redhat data grid
- canonical/redhat jboss data grid
- canonical/redhat jboss enterprise application platform
- version/redhat jboss enterprise application platform/6
- vendor/infinispan
- canonical/infinispan infinispan
- package-manager/maven