CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-3628
Medium (6.5). EPSS 0.8% chance of exploitation in the next 30 days. Fixed in org.infinispan:infinispan-server-rest 14.0.18.Final, 15.0.0.Dev04.
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
- CWE
- CWE-304
- Published
- Modified
- Record from
- the NVD, synced
Affected
- infinispan:infinispan
- redhat:data_grid
- redhat:jboss_data_grid
- redhat:jboss_enterprise_application_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fhr7-8jx4-r9cp | Maven | org.infinispan:infinispan-server-rest | >=15.0.0.Dev01 <15.0.0.Dev04 | 15.0.0.Dev04 |
| GHSA-fhr7-8jx4-r9cp | Maven | org.infinispan:infinispan-server-rest | <14.0.18.Final | 14.0.18.Final |