High severity7.2NVD Advisory· Published Dec 18, 2023· Updated Jun 17, 2026
CVE-2023-5384
CVE-2023-5384
Description
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.infinispan:infinispan-coreMaven | >= 15.0.0.Dev01, < 15.0.0.Dev07 | 15.0.0.Dev07 |
org.infinispan:infinispan-coreMaven | < 14.0.25.Final | 14.0.25.Final |
org.infinispan:infinispan-commonsMaven | >= 15.0.0.Dev01, < 15.0.0.Dev07 | 15.0.0.Dev07 |
org.infinispan:infinispan-commonsMaven | < 14.0.25.Final | 14.0.25.Final |
org.infinispan:infinispan-hotrodMaven | >= 15.0.0.Dev01, < 15.0.0.Dev07 | 15.0.0.Dev07 |
org.infinispan:infinispan-hotrodMaven | < 14.0.25.Final | 14.0.25.Final |
org.infinispan:infinispan-client-hotrodMaven | >= 15.0.0.Dev01, < 15.0.0.Dev07 | 15.0.0.Dev07 |
org.infinispan:infinispan-client-hotrodMaven | < 14.0.25.Final | 14.0.25.Final |
org.infinispan:infinispan-cachestore-jdbc-commonMaven | >= 15.0.0.Dev01, < 15.0.0.Dev07 | 15.0.0.Dev07 |
org.infinispan:infinispan-cachestore-jdbc-commonMaven | < 14.0.25.Final | 14.0.25.Final |
org.infinispan:infinispan-cachestore-remoteMaven | >= 15.0.0.Dev01, < 15.0.0.Dev07 | 15.0.0.Dev07 |
org.infinispan:infinispan-cachestore-remoteMaven | < 14.0.25.Final | 14.0.25.Final |
org.infinispan:infinispan-cachestore-sqlMaven | >= 15.0.0.Dev01, < 15.0.0.Dev07 | 15.0.0.Dev07 |
org.infinispan:infinispan-cachestore-sqlMaven | < 14.0.25.Final | 14.0.25.Final |
org.infinispan:infinispan-cachestore-jdbcMaven | >= 15.0.0.Dev01, < 15.0.0.Dev07 | 15.0.0.Dev07 |
org.infinispan:infinispan-cachestore-jdbcMaven | < 14.0.25.Final | 14.0.25.Final |
Affected products
24- Red Hat/Red Hat Data Grid 8.4.6v5cpe:/a:redhat:jboss_data_grid:8
- ghsa-coords20 versionspkg:maven/org.infinispan/infinispan-corepkg:maven/org.infinispan/infinispan-commonspkg:maven/org.infinispan/infinispan-hotrodpkg:maven/org.infinispan/infinispan-client-hotrodpkg:maven/org.infinispan/infinispan-cachestore-jdbc-commonpkg:maven/org.infinispan/infinispan-cachestore-remotepkg:maven/org.infinispan/infinispan-cachestore-sqlpkg:maven/org.infinispan/infinispan-cachestore-jdbcpkg:apk/chainguard/infinispan-15.1-compatpkg:apk/chainguard/infinispan-15.0pkg:apk/chainguard/infinispan-15.0-compatpkg:apk/chainguard/infinispan-15.0-imagespkg:apk/chainguard/infinispan-15.1pkg:apk/chainguard/infinispan-15.1-imagespkg:apk/chainguard/infinispan-15.2pkg:apk/chainguard/infinispan-15.2-compatpkg:apk/chainguard/infinispan-15.2-imagespkg:apk/wolfi/infinispan-15.2pkg:apk/wolfi/infinispan-15.2-compatpkg:apk/wolfi/infinispan-15.2-images
>= 15.0.0.Dev01, < 15.0.0.Dev07+ 19 more
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev07
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev07
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev07
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev07
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev07
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev07
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev07
- (no CPE)range: >= 15.0.0.Dev01, < 15.0.0.Dev07
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- cpe:2.3:a:infinispan:infinispan:-:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
12- access.redhat.com/errata/RHSA-2023:7676nvdVendor AdvisoryWEB
- access.redhat.com/security/cve/CVE-2023-5384nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-gg57-587f-h5v6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-5384ghsaADVISORY
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingWEB
- github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47ghsaWEB
- github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61ghsaWEB
- github.com/infinispan/infinispan/pull/11555ghsaWEB
- github.com/infinispan/infinispan/pull/11995ghsaWEB
- issues.redhat.com/browse/ISPN-15202ghsaWEB
- security.netapp.com/advisory/ntap-20240125-0004ghsaWEB
- security.netapp.com/advisory/ntap-20240125-0004/nvd
News mentions
0No linked articles in our index yet.