CVE-2017-2638CWE-306

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints

Medium · published July 16, 2018

CVSS v3.0
6.5
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01559 · 75.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2018-07-16T13:00Z
EPSS history
Timeline
  • 16 JUL 13:00Z
    It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints
    cvelistv5