GitHub Advisoryadvisory · Maven

GHSA-r4w2-hjmr-36m7 Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions

HIGH Published 2023-12-30 Modified 2024-11-18 Official page ↗
Aliases
CVE-2023-3629
Ecosystem
Maven
Packages
org.infinispan:infinispan-server-rest
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-304
Reviewed
2024-09-16

Affected packages

• Maven org.infinispan:infinispan-server-rest: >= 15.0.0.Dev01, < 15.0.0.Dev04 → fixed in 15.0.0.Dev04 • Maven org.infinispan:infinispan-server-rest: < 14.0.18.Final → fixed in 14.0.18.Final

Description

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

Related

Alias · CVE (1)

  • CVE-2023-3629 A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. vulnerability

Weakness · CWE (1)

  • CWE-304 Missing Critical Step in Authentication weakness

References