CVE-2023-3628
published 2023-12-18CVE-2023-3628: A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated…
PriorityP334medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.64%
46.6th percentile
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | data_grid | < 8.4.4 | 8.4.4 |
| redhat | jboss_enterprise_application_platform | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
osv·2023-12-30
CVE-2023-3628 [HIGH] Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
GHSA
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
ghsa·2023-12-30
CVE-2023-3628 [HIGH] CWE-304 Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Red Hat
infispan: REST bulk ops don't check permissions
vendor_redhat·2023-09-21·CVSS 6.5
CVE-2023-3628 [MEDIUM] CWE-304 infispan: REST bulk ops don't check permissions
infispan: REST bulk ops don't check permissions
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Package: infinispan (Red Hat JBoss Enterprise Application Platform 6) - Out of support scope
No detection rules found.
No public exploits indexed.
https://access.redhat.com/errata/RHSA-2023:5396https://access.redhat.com/security/cve/CVE-2023-3628https://bugzilla.redhat.com/show_bug.cgi?id=2217924https://access.redhat.com/errata/RHSA-2023:5396https://access.redhat.com/security/cve/CVE-2023-3628https://bugzilla.redhat.com/show_bug.cgi?id=2217924https://security.netapp.com/advisory/ntap-20240125-0004/
2023-12-18
Published