GHSA-r4w2-hjmr-36m7
Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-3629
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.infinispan:infinispan-server-rest | introduced 15.0.0.Dev01, fixed 15.0.0.Dev04 |
| Maven · org.infinispan:infinispan-server-rest | introduced 0, fixed 14.0.18.Final |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2023-3629 ADVISORY
- https://github.com/infinispan/infinispan/commit/11b3cb0f7ba68b73dd32f655ff3f3df842a0c6bd WEB
- https://github.com/infinispan/infinispan/commit/1e3cc542336d2f49743ab8176ed6f1175e034c59 WEB
- https://access.redhat.com/errata/RHSA-2023:5396 WEB
- https://access.redhat.com/security/cve/CVE-2023-3629 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2217926 WEB
- https://github.com/infinispan/infinispan PACKAGE
- https://security.netapp.com/advisory/ntap-20240125-0004 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |