CVE-2023-3629
Infinispan: non-admins should not be able to get cache config via rest api
- State
- Published
- Severity
- 4.3 Medium
- Published
- Dec 18, 2023
- Updated
- Nov 7, 2025
- Reserved
- Jul 11, 2023
Description
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | redhat |
Weaknesses
- CWE-304 Missing Critical Step in Authentication
Affected Products
| Product | Versions |
|---|---|
Red Hat Data Grid 8.4.4Red Hat | |
Red Hat JBoss Enterprise Application Platform 6Red Hat |
References
- RHSA-2023:5396vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-3629vdb-entry
- RHBZ#2217926issue-tracking
- https://security.netapp.com/advisory/ntap-20240125-0004/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.