GHSA-fhr7-8jx4-r9cp
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
At a glance
- Published
- Updated
- CVE
- CVE-2023-3628
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.infinispan:infinispan-server-rest | introduced 15.0.0.Dev01, fixed 15.0.0.Dev04 |
| Maven · org.infinispan:infinispan-server-rest | introduced 0, fixed 14.0.18.Final |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3628 ADVISORY
- https://github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263 WEB
- https://github.com/infinispan/infinispan/commit/b34488dcab8bdd4258972568b8405ee7111276ec WEB
- https://access.redhat.com/errata/RHSA-2023:5396 WEB
- https://access.redhat.com/security/cve/CVE-2023-3628 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2217924 WEB
- https://github.com/infinispan/infinispan PACKAGE
- https://security.netapp.com/advisory/ntap-20240125-0004 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |