CVE-2023-3629: Infinispan: non-admins should not be able to get cache config via rest api

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-18 · updated 2026-06-17
Weakness: CWE-304

Description

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

Affected products

Red Hat infinispan: all versions
RedHat Data Grid: before 8.4.4 — fixed in 8.4.4
RedHat Jboss Data Grid: all versions
Red Hat JBoss EAP: 6

How to fix

Upgrade to a fixed version: RedHat Data Grid 8.4.4. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2023:5396
https://access.redhat.com/security/cve/CVE-2023-3629
https://bugzilla.redhat.com/show_bug.cgi?id=2217926
https://access.redhat.com/errata/RHSA-2023:5396
https://access.redhat.com/security/cve/CVE-2023-3629
https://bugzilla.redhat.com/show_bug.cgi?id=2217926
https://security.netapp.com/advisory/ntap-20240125-0004/

Get alerted when CVE-2023-3629 or the next vulnerability affects your stack