CVE-2023-3628: A flaw was found in Infinispan's REST

Medium severity · published Dec 18, 2023

CVE-2023-3628

A flaw was found in Infinispan's REST

6.5

CVSS

0.8%

EPSS

On KEV

Description

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Data Grid · Redhat

before 8.4.4 · source: NVD

Infinispan · Infinispan

All versions, or not specified · source: NVD

Jboss Data Grid · Redhat

All versions, or not specified · source: NVD

Jboss Enterprise Application Platform · Redhat

6 · source: NVD

Affected product

Infinispan

All Infinispan CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-3628

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-3628

Vendor Advisory

https://access.redhat.com/errata/RHSA-2023:5396

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2023-3628

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=2217924

security.netapp.com

https://security.netapp.com/advisory/ntap-20240125-0004/