Medium severity6.5NVD Advisory· Published Dec 18, 2023· Updated Jun 17, 2026
CVE-2023-3628
CVE-2023-3628
Description
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.infinispan:infinispan-server-restMaven | >= 15.0.0.Dev01, < 15.0.0.Dev04 | 15.0.0.Dev04 |
org.infinispan:infinispan-server-restMaven | < 14.0.18.Final | 14.0.18.Final |
Affected products
19- Red Hat/Red Hat Data Grid 8.4.4v5cpe:/a:redhat:jboss_data_grid:8
- osv-coords13 versionspkg:apk/chainguard/infinispan-15.1-compatpkg:apk/chainguard/infinispan-15.1-imagespkg:apk/wolfi/infinispan-15.2-compatpkg:apk/wolfi/infinispan-15.2-imagespkg:maven/org.infinispan/infinispan-server-restpkg:apk/chainguard/infinispan-15.0-compatpkg:apk/chainguard/infinispan-15.2-compatpkg:apk/chainguard/infinispan-15.2-imagespkg:apk/wolfi/infinispan-15.2pkg:apk/chainguard/infinispan-15.0pkg:apk/chainguard/infinispan-15.0-imagespkg:apk/chainguard/infinispan-15.1pkg:apk/chainguard/infinispan-15.2
< 15.1.7-r3+ 12 more
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev04
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.2.6-r1
cpe:/a:redhat:jboss_enterprise_application_platform:6+ 1 more
- cpe:/a:redhat:jboss_enterprise_application_platform:6
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:6:*:*:*:*:*:*:*
- cpe:2.3:a:infinispan:infinispan:-:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
9- access.redhat.com/errata/RHSA-2023:5396nvdVendor AdvisoryWEB
- access.redhat.com/security/cve/CVE-2023-3628nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-fhr7-8jx4-r9cpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-3628ghsaADVISORY
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingWEB
- github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263ghsaWEB
- github.com/infinispan/infinispan/commit/b34488dcab8bdd4258972568b8405ee7111276ecghsaWEB
- security.netapp.com/advisory/ntap-20240125-0004ghsaWEB
- security.netapp.com/advisory/ntap-20240125-0004/nvd
News mentions
0No linked articles in our index yet.