GitHub Advisoryadvisory · Maven

GHSA-269m-c36j-r834 Infinispan vulnerable to Insertion of Sensitive Information into Log File

MEDIUM Published 2025-01-28 Modified 2025-03-12 Official page ↗
Aliases
CVE-2025-0736
Ecosystem
Maven
Packages
org.infinispan:infinispan-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2025-01-28

Affected packages

• Maven org.infinispan:infinispan-parent: <= 15.1.4.Final (no fix yet)

Description

A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors.

Related

Alias · CVE (1)

  • CVE-2025-0736 A flaw was found in Infinispan, when using JGroups with JDBC_PING. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References