6.5
CVE-2023-3628
- EPSS 0.12%
- Published 18.12.2023 14:15:08
- Last modified 21.11.2024 08:17:42
- Source secalert@redhat.com
- Teams watchlist Login
- Open Login
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Data is provided by the National Vulnerability Database (NVD)
Redhat ≫ Jboss Data Grid Version- SwEditiontext-only
Redhat ≫ Jboss Enterprise Application Platform Version6
Infinispan ≫ Infinispan Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.12% | 0.31 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| secalert@redhat.com | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
CWE-304 Missing Critical Step in Authentication
The product implements an authentication technique, but it skips a step that weakens the technique.