Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yNHcyLWhqbXItMzZtN84AA4G2

Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

Permalink: https://github.com/advisories/GHSA-r4w2-hjmr-36m7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yNHcyLWhqbXItMzZtN84AA4G2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 11 months ago
Updated: 14 days ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-r4w2-hjmr-36m7, CVE-2023-3629
References:

• https://nvd.nist.gov/vuln/detail/CVE-2023-3629
• https://access.redhat.com/errata/RHSA-2023:5396
• https://access.redhat.com/security/cve/CVE-2023-3629
• https://bugzilla.redhat.com/show_bug.cgi?id=2217926
• https://security.netapp.com/advisory/ntap-20240125-0004
• https://github.com/infinispan/infinispan/commit/11b3cb0f7ba68b73dd32f655ff3f3df842a0c6bd
• https://github.com/infinispan/infinispan/commit/1e3cc542336d2f49743ab8176ed6f1175e034c59
• https://github.com/advisories/GHSA-r4w2-hjmr-36m7

Repository: https://github.com/infinispan/infinispan
Blast Radius: 10.3

Affected Packages