CVE-2017-2638

CWE-306 — Missing AuthenticationCWE-287 — Improper Authentication6 documents6 sources
Severity
6.5MEDIUM
EPSS
0.5%
top 34.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Infinispan Infinispan[unknown] InfinispanRedhat Jboss Data Grid
Timeline
PublishedJul 16
Latest updateMay 13

Description

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5

Affected Packages4 packages

▶CVEListV5[unknown]/infinispanInfinispan 9.0.0.Final

Patches

Patch: bugzilla.redhat.com ↗Patch: github.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
Infinispan Rest API Does Not Enforce Auth Constraints↗2022-05-13
▶
OSV
Infinispan Rest API Does Not Enforce Auth Constraints↗2022-05-13
▶
CVEList
CVE-2017-2638: It was found that the REST API in Infinispan before version 9↗2018-07-16
▶

📋Vendor Advisories

1
Red Hat
infinispan: auth bypass in REST api↗2017-04-19
▶

💬Community

1
Bugzilla
CVE-2017-2638 infinispan: auth bypass in REST api↗2017-03-02
▶