CVE-2023-3628: Infispan: rest bulk ops don't check permissions

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-18 · updated 2026-06-17
Weakness: CWE-304

Description

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

Affected products

Red Hat infinispan: all versions
RedHat Data Grid: before 8.4.4 — fixed in 8.4.4
RedHat Jboss Data Grid: all versions
Red Hat JBoss EAP: 6

How to fix

Upgrade to a fixed version: RedHat Data Grid 8.4.4. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2023:5396
https://access.redhat.com/security/cve/CVE-2023-3628
https://bugzilla.redhat.com/show_bug.cgi?id=2217924
https://access.redhat.com/errata/RHSA-2023:5396
https://access.redhat.com/security/cve/CVE-2023-3628
https://bugzilla.redhat.com/show_bug.cgi?id=2217924
https://security.netapp.com/advisory/ntap-20240125-0004/

Get alerted when CVE-2023-3628 or the next vulnerability affects your stack