CVEvulnerability
CVE-2023-3628
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-12-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-304
Description
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Affected configurations
• redhat jboss data grid
• redhat jboss enterprise application platform 6
• redhat data grid (< 8.4.4)
• infinispan infinispan
Related
Weakness · CWE (1)
- CWE-304 Missing Critical Step in Authentication weakness
References
- https://access.redhat.com/errata/RHSA-2023:5396 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-3628 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2217924 Issue Tracking
- https://access.redhat.com/errata/RHSA-2023:5396 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-3628 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2217924 Issue Tracking
- https://security.netapp.com/advisory/ntap-20240125-0004/ security.netapp.com