CVE-2023-3629 — Infinispan: non-admins should not be able to get cache config via rest api

Description (CNA)

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Data Grid 8.4.4	unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 6	unknown

CWE

CWE-304

References

https://access.redhat.com/errata/RHSA-2023:5396
https://access.redhat.com/security/cve/CVE-2023-3629
https://bugzilla.redhat.com/show_bug.cgi?id=2217926

ADP enrichment

CVE

No English description supplied.

https://access.redhat.com/errata/RHSA-2023:5396
https://access.redhat.com/security/cve/CVE-2023-3629
https://bugzilla.redhat.com/show_bug.cgi?id=2217926
https://security.netapp.com/advisory/ntap-20240125-0004/

CISA-ADP

No English description supplied.

No references supplied.