CVEvulnerability
CVE-2023-3629
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-12-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-304
Description
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Affected configurations
• redhat data grid (< 8.4.4)
• redhat jboss data grid
• redhat jboss enterprise application platform 6
• infinispan infinispan
Related
Weakness · CWE (1)
- CWE-304 Missing Critical Step in Authentication weakness
References
- https://access.redhat.com/errata/RHSA-2023:5396 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-3629 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2217926 Issue Tracking
- https://access.redhat.com/errata/RHSA-2023:5396 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-3629 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2217926 Issue Tracking
- https://security.netapp.com/advisory/ntap-20240125-0004/ security.netapp.com