GitHub Advisoryadvisory · Maven
GHSA-mvxp-3j62-jqr6 Infinispan Rest API Does Not Enforce Auth Constraints
MEDIUM
Official page ↗
- Aliases
- CVE-2017-2638
- Ecosystem
- Maven
- Packages
- org.infinispan:infinispan-server-core
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-287
- Reviewed
- 2023-07-31
Affected packages
• Maven org.infinispan:infinispan-server-core: < 9.0.0 → fixed in 9.0.0
Description
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Related
Alias · CVE (1)
- CVE-2017-2638 It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-2638 advisory
- https://github.com/infinispan/infinispan/pull/4936 web
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638 web
- https://issues.jboss.org/browse/ISPN-7485 web
- http://rhn.redhat.com/errata/RHSA-2017-1097.html web
- http://www.securityfocus.com/bid/97964 web