CVE-2017-2638
published 2018-07-16CVE-2017-2638: It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read…
PriorityP335medium6.5CVSS 3.0
AVNACLPRNUINSUCLILAN
EPSS
1.56%
72.4th percentile
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| infinispan | infinispan | < 9.0.0 | 9.0.0 |
| redhat | jboss_data_grid | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Infinispan Rest API Does Not Enforce Auth Constraints
ghsa·2022-05-13
CVE-2017-2638 [MEDIUM] CWE-287 Infinispan Rest API Does Not Enforce Auth Constraints
Infinispan Rest API Does Not Enforce Auth Constraints
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
OSV
Infinispan Rest API Does Not Enforce Auth Constraints
osv·2022-05-13
CVE-2017-2638 [MEDIUM] Infinispan Rest API Does Not Enforce Auth Constraints
Infinispan Rest API Does Not Enforce Auth Constraints
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Red Hat
infinispan: auth bypass in REST api
vendor_redhat·2017-04-19·CVSS 6.5
CVE-2017-2638 [MEDIUM] CWE-306 infinispan: auth bypass in REST api
infinispan: auth bypass in REST api
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
It was found that the REST API in infinispan did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Package: rest (Red Hat JBoss Data Grid 6) - Affected
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2017-1097.htmlhttp://www.securityfocus.com/bid/97964https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638https://github.com/infinispan/infinispan/pull/4936/commitshttps://issues.jboss.org/browse/ISPN-7485http://rhn.redhat.com/errata/RHSA-2017-1097.htmlhttp://www.securityfocus.com/bid/97964https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638https://github.com/infinispan/infinispan/pull/4936/commitshttps://issues.jboss.org/browse/ISPN-7485
2018-07-16
Published