Description
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Data Grid 8.4.4 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 6 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.infinispan:infinispan-server-rest | >= 15.0.0.Dev01, < 15.0.0.Dev04 | 15.0.0.Dev04 | GHSA-r4w2-hjmr-36m7 |
| Maven | org.infinispan:infinispan-server-rest | < 14.0.18.Final | 14.0.18.Final | GHSA-r4w2-hjmr-36m7 |
Advisories 1
- WID-SEC-2023-2518 Red Hat JBoss Data Grid: Mehre Schwachstellen BSI CERT-Bund (WID) · Jul 1, 2024
References
- RHSA-2023:5396 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-3629 vdb-entry
- RHBZ#2217926 issue-tracking