CVE-2023-3628

CVE-2023-3628 affects Infinispan REST: bulk read endpoints fail to properly enforce user permissions, potentially allowing an authenticated user to access data outside their intended scope. The condition is documented across multiple sources (GHSA-FHR7-8JX4-R9CP, NVD/NVD-linked CVE, and Red Hat a...

CVE-2023-3629 Infinispan: non-admins should not be able to get cache config via rest api

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions...

CVE-2023-3629 Infinispan: non-admins should not be able to get cache config via rest api

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions...

PT-2023-25509 · Unknown · Infinispan

Name of the Vulnerable Software and Affected Versions: Infinispan affected versions not specified Description: A flaw was found in Infinispan's REST, where bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access...

PT-2023-31964 · Unknown · Infinispan

Name of the Vulnerable Software and Affected Versions: Infinispan affected versions not specified Description: A flaw was found in the software, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously...

PT-2023-25515 · Unknown · Infinispan

Name of the Vulnerable Software and Affected Versions: Infinispan affected versions not specified Description: A flaw was found in Infinispan's REST, where Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated...

PT-2023-32082 · Unknown · Infinispan

Name of the Vulnerable Software and Affected Versions: Infinispan affected versions not specified Description: A flaw was found in the serialization of cache configurations to XML, JSON, or YAML formats, which can contain credentials such as those used in JDBC stores with connection pooling or...

infinispan: Credentials returned from configuration as clear text

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials JDBC store with connection pooling, remote store, the credentials are returned in clear text as part of the configuration...

CVE-2023-5384

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials JDBC store with connection pooling, remote store, the credentials are returned in clear text as part of the configuration. Mitigation The issue's impact is limited because...

Red Hat Infinispan Security Vulnerability

Red Hat Infinispan is a suite of distributed caching and key-value NoSQL datastore software from Red Hat USA. A security vulnerability exists in Red Hat Infinispan that stems from returning credentials from a configuration in plaintext...

infispan: REST bulk ops don't check permissions

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions...

infinispan: circular reference on marshalling leads to DoS

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service...

infinispan: Non-admins should not be able to get cache config via REST API

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions...

CVE-2023-5236

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service...

Red Hat Infinispan Security Vulnerability

Red Hat Infinispan is a distributed cache and key-value NoSQL datastore from Red Hat. Red Hat Infinispan suffers from a security vulnerability that stems from not detecting circular object references during ungrouping, which can be exploited by an attacker to insert maliciously constructed object...

CVE-2023-3629

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions...

CVE-2023-3628

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions...

Red Hat Infinispan Security Vulnerability

Red Hat Infinispan is a distributed caching and key-value NoSQL datastore software from Red Hat, USA. A security vulnerability exists in Red Hat Infinispan that stems from a bulk read endpoint that does not properly evaluate user privileges for operations...

Red Hat Infinispan Security Vulnerability

Red Hat Infinispan is a distributed cache and key-value NoSQL data store software from Red Hat, Inc. A security vulnerability exists in Red Hat Infinispan that stems from the cache retrieval endpoint not properly evaluating administrator privileges required for operation...

Hot Rod 信任管理问题漏洞

Hot Rod is a wired protocol used by Infinispan clients to communicate with remote grids from the Infinispan organization. A security vulnerability exists in Hot Rod that stems from not enabling hostname authentication when using TLS, which could lead to a man-in-the-middle attack...