CVE-2023-3629CWE-304

Infinispan: non-admins should not be able to get cache config via rest api

Medium · published December 18, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00721 · 53.4th percentile
Weakness
CWE-304 · Missing Critical Step in Authentication
Published
2023-12-18T13:43Z
EPSS history
Timeline
  • 18 DEC 13:43Z
    Infinispan: non-admins should not be able to get cache config via rest api
    cvelistv5