Description
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Data Grid 8.4.4 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 6 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.infinispan:infinispan-server-rest | >= 15.0.0.Dev01, < 15.0.0.Dev04 | 15.0.0.Dev04 | GHSA-fhr7-8jx4-r9cp |
| Maven | org.infinispan:infinispan-server-rest | < 14.0.18.Final | 14.0.18.Final | GHSA-fhr7-8jx4-r9cp |
Advisories 1
- WID-SEC-2023-2518 Red Hat JBoss Data Grid: Mehre Schwachstellen BSI CERT-Bund (WID) · Jul 1, 2024
References
- RHSA-2023:5396 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-3628 vdb-entry
- RHBZ#2217924 issue-tracking