CVE-2023-3629: A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation

Medium severity · published Dec 18, 2023

CVE-2023-3629

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation

6.5

CVSS

0.7%

EPSS

On KEV

Description

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 54% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Data Grid · Redhat

before 8.4.4 · source: NVD

Infinispan · Infinispan

All versions, or not specified · source: NVD

Jboss Data Grid · Redhat

All versions, or not specified · source: NVD

Jboss Enterprise Application Platform · Redhat

6 · source: NVD

Affected product

Infinispan

All Infinispan CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-3629

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-3629

Vendor Advisory

https://access.redhat.com/errata/RHSA-2023:5396

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2023-3629

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=2217926

security.netapp.com

https://security.netapp.com/advisory/ntap-20240125-0004/