CVE-2023-3628CWE-304

Infispan: rest bulk ops don't check permissions

Medium · published December 18, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
56.0
In the wild
Unconfirmed
What it is

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00797 · 56.0th percentile
Weakness
CWE-304 · Missing Critical Step in Authentication
Published
2023-12-18T13:43Z
EPSS history
Timeline
  • 18 DEC 13:43Z
    Infispan: rest bulk ops don't check permissions
    cvelistv5