CVE-2023-3628
Infispan: rest bulk ops don't check permissions
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Infispan: rest bulk ops don't check permissions
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
CVE-2023-3628- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
EUVDEUVD-2023-3198
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
EUVD-2023-3198- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fhr7-8jx4-r9cp
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
GHSA-fhr7-8jx4-r9cp- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
NVD
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
CVE-2023-3628- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
OSVGHSA-fhr7-8jx4-r9cp
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
GHSA-fhr7-8jx4-r9cp- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.infinispan:infinispan-server-restMaven |
15.0.0.Dev01 up to 15.0.0.Dev04 | 15.0.0.Dev04 |
org.infinispan:infinispan-server-restMaven |
before 14.0.18.Final | 14.0.18.Final |
org.infinispan:infinispan-server-restMaven |
15.0.0.Dev01 up to 15.0.0.Dev04, plus listed versions 15.0.0.Dev0215.0.0.Dev03 |
15.0.0.Dev04 |
org.infinispan:infinispan-server-restMaven |
before 14.0.18.Final, plus listed versions 10.0.0.Alpha110.0.0.Alpha210.0.0.Alpha310.0.0.Beta110.0.0.Beta2 Show 45 moreShow less10.0.0.Beta310.0.0.Beta410.0.0.Beta510.0.0.CR110.0.0.CR210.0.0.CR310.0.0.Final10.0.1.Final10.1.0.Beta110.1.0.CR110.1.0.Final10.1.1.Final10.1.2.Final10.1.3.Final10.1.4.Final10.1.5.Final10.1.6.Final10.1.7.Final10.1.8.Final10.1.9.Final11.0.0.Alpha11.0.0.Alpha111.0.0.Alpha211.0.0.CR111.0.0.Dev0311.0.0.Dev0411.0.0.Dev0511.0.0.Final11.0.1.Final11.0.10.Final11.0.11.Final11.0.13.Final11.0.14.Final11.0.15.Final11.0.16.Final11.0.17.Final11.0.18.Final11.0.19.Final11.0.2.Final11.0.3.Final11.0.4.Final11.0.5.Final11.0.6.Final11.0.7.Final11.0.8.Final |
14.0.18.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-3628 is a medium vulnerability (CVSS 6.5) in Infinispan, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in org.infinispan:infinispan-server-rest 15.0.0.Dev04.
References
access.redhat.com/errata/RHSA-2023:5396
bugzilla.redhat.com/show_bug.cgi?id=2217924
security.netapp.com/advisory/ntap-20240125-0004
nvd.nist.gov/vuln/detail/CVE-2023-3628
github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263
Left out here: 310 versions. The JSON record has them.