CVE-2023-3629: Infinispan: non-admins should not be able to get cache config via rest api
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Other sources
The REST endpoint to retrieve cache configurations doesn't check for ADMIN permissions: GET /rest/v2/caches/{cacheName}?action=config GET /rest/v2/caches The cache configuration may contain information about filesystem paths and allowed security roles which should not be viewable by non-administrators. The first method should return a 403 in case the user doesn't have appropriate permissions. The second method should omit the full cache configuration from the response (it returns other, non-security sensitive information). The methods require authentication, but once authenticated, any user can invoke them successfully.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3629?
CVE-2023-3629 is considered a moderate severity vulnerability due to improper permission checks in Infinispan's REST endpoints.
How do I fix CVE-2023-3629?
To remediate CVE-2023-3629, upgrade to Infinispan version 14.0.18.Final or 15.0.0.Dev04 or apply necessary patches as indicated by vendor advisories.
What impact does CVE-2023-3629 have on user access?
CVE-2023-3629 could allow authenticated users to access sensitive cache information that they should not have permission to view.
Which Infinispan versions are affected by CVE-2023-3629?
CVE-2023-3629 affects Infinispan versions prior to 14.0.18.Final and those between 15.0.0.Dev01 and 15.0.0.Dev04.
Is user authentication sufficient to protect against CVE-2023-3629?
No, user authentication alone is inadequate because the flaw allows authenticated users to bypass intended access controls.