CVE-2023-3629
Infinispan: non-admins should not be able to get cache config via rest api
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Infinispan: non-admins should not be able to get cache config via rest api
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
CVE-2023-3629- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
EUVDEUVD-2023-3281
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
EUVD-2023-3281- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r4w2-hjmr-36m7
Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
GHSA-r4w2-hjmr-36m7- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
NVD
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
CVE-2023-3629- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
OSVGHSA-r4w2-hjmr-36m7
Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- Record
GHSA-r4w2-hjmr-36m7- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-304
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.infinispan:infinispan-server-restMaven |
15.0.0.Dev01 up to 15.0.0.Dev04 | 15.0.0.Dev04 |
org.infinispan:infinispan-server-restMaven |
before 14.0.18.Final | 14.0.18.Final |
org.infinispan:infinispan-server-restMaven |
15.0.0.Dev01 up to 15.0.0.Dev04, plus listed versions 15.0.0.Dev0215.0.0.Dev03 |
15.0.0.Dev04 |
org.infinispan:infinispan-server-restMaven |
before 14.0.18.Final, plus listed versions 10.0.0.Alpha110.0.0.Alpha210.0.0.Alpha310.0.0.Beta110.0.0.Beta2 Show 45 moreShow less10.0.0.Beta310.0.0.Beta410.0.0.Beta510.0.0.CR110.0.0.CR210.0.0.CR310.0.0.Final10.0.1.Final10.1.0.Beta110.1.0.CR110.1.0.Final10.1.1.Final10.1.2.Final10.1.3.Final10.1.4.Final10.1.5.Final10.1.6.Final10.1.7.Final10.1.8.Final10.1.9.Final11.0.0.Alpha11.0.0.Alpha111.0.0.Alpha211.0.0.CR111.0.0.Dev0311.0.0.Dev0411.0.0.Dev0511.0.0.Final11.0.1.Final11.0.10.Final11.0.11.Final11.0.13.Final11.0.14.Final11.0.15.Final11.0.16.Final11.0.17.Final11.0.18.Final11.0.19.Final11.0.2.Final11.0.3.Final11.0.4.Final11.0.5.Final11.0.6.Final11.0.7.Final11.0.8.Final |
14.0.18.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-3629 is a medium vulnerability (CVSS 4.3) in Infinispan, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in org.infinispan:infinispan-server-rest 15.0.0.Dev04.
References
access.redhat.com/errata/RHSA-2023:5396
bugzilla.redhat.com/show_bug.cgi?id=2217926
security.netapp.com/advisory/ntap-20240125-0004
nvd.nist.gov/vuln/detail/CVE-2023-3629
github.com/infinispan/infinispan/commit/11b3cb0f7ba68b73dd32f655ff3f3df842a0c6bd
Left out here: 310 versions. The JSON record has them.