CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2023-3629
Medium (6.5). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in org.infinispan:infinispan-server-rest 14.0.18.Final, 15.0.0.Dev04.
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWE
- CWE-304
- Published
- Modified
- Record from
- the NVD, synced
Affected
- infinispan:infinispan
- redhat:data_grid
- redhat:jboss_data_grid
- redhat:jboss_enterprise_application_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r4w2-hjmr-36m7 | Maven | org.infinispan:infinispan-server-rest | >=15.0.0.Dev01 <15.0.0.Dev04 | 15.0.0.Dev04 |
| GHSA-r4w2-hjmr-36m7 | Maven | org.infinispan:infinispan-server-rest | <14.0.18.Final | 14.0.18.Final |