GitHub Advisoryadvisory · Maven
GHSA-fhr7-8jx4-r9cp Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
HIGH
Official page ↗
- Aliases
- CVE-2023-3628
- Ecosystem
- Maven
- Packages
- org.infinispan:infinispan-server-rest
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-304
- Reviewed
- 2024-09-16
Affected packages
• Maven org.infinispan:infinispan-server-rest: >= 15.0.0.Dev01, < 15.0.0.Dev04 → fixed in 15.0.0.Dev04
• Maven org.infinispan:infinispan-server-rest: < 14.0.18.Final → fixed in 14.0.18.Final
Description
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Related
Alias · CVE (1)
- CVE-2023-3628 A flaw was found in Infinispan's REST. vulnerability
Weakness · CWE (1)
- CWE-304 Missing Critical Step in Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-3628 advisory
- https://github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263 web
- https://github.com/infinispan/infinispan/commit/b34488dcab8bdd4258972568b8405ee7111276ec web
- https://access.redhat.com/errata/RHSA-2023:5396 web
- https://access.redhat.com/security/cve/CVE-2023-3628 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2217924 web
- https://github.com/infinispan/infinispan package
- https://security.netapp.com/advisory/ntap-20240125-0004 web