CVE-2023-3628
Infispan: rest bulk ops don't check permissions
- State
- Published
- Severity
- 6.5 Medium
- Published
- Dec 18, 2023
- Updated
- Nov 7, 2025
- Reserved
- Jul 11, 2023
Description
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-304 Missing Critical Step in Authentication
Affected Products
| Product | Versions |
|---|---|
Red Hat Data Grid 8.4.4Red Hat | |
Red Hat JBoss Enterprise Application Platform 6Red Hat |
References
- RHSA-2023:5396vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-3628vdb-entry
- RHBZ#2217924issue-tracking
- https://security.netapp.com/advisory/ntap-20240125-0004/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.