CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2023-5384 – Infinispan: credentials returned from configuration as clear text
https://notcve.org/view.php?id=CVE-2023-5384
18 Dec 2023 — A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration. Se encontró una falla en Infinispan. Al serializar la configuración de una caché en XML/JSON/YAML, que contiene credenciales (almacén JDBC con agrupación de conexiones, almacén remoto), las credenciales se devuelven en texto plano como parte de la configuración. • https://access.redhat.com/errata/RHSA-2023:7676 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-4586 – Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack
https://notcve.org/view.php?id=CVE-2023-4586
04 Oct 2023 — A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack. Se encontró una vulnerabilidad en el cliente Hot Rod. Este problema de seguridad ocurre porque el cliente Hot Rod no habilita la validación del nombre de host cuando usa TLS, lo que posiblemente resulte en un ataque de man-in-the-middle (MITM). An update for Red Hat Data Grid 8 is now available. • https://access.redhat.com/errata/RHSA-2023:7676 • CWE-20: Improper Input Validation CWE-295: Improper Certificate Validation •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-3628 – Infispan: rest bulk ops don't check permissions
https://notcve.org/view.php?id=CVE-2023-3628
28 Sep 2023 — A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions. Se encontró una falla en el REST de Infinispan. Los endpoints de lectura masiva no evalúan adecuadamente los permisos de usuario para la operación. • https://access.redhat.com/errata/RHSA-2023:5396 • CWE-304: Missing Critical Step in Authentication •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-3629 – Infinispan: non-admins should not be able to get cache config via rest api
https://notcve.org/view.php?id=CVE-2023-3629
28 Sep 2023 — A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions. Se encontró una falla en REST de Infinispan: los endpoints de recuperación de caché no evalúan adecuadamente los permisos de administrador necesarios para la operación. Este problema podría permitir que un usuario autenticado acceda a información fuera de sus permi... • https://access.redhat.com/errata/RHSA-2023:5396 • CWE-304: Missing Critical Step in Authentication •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-5236 – Infinispan: circular reference on marshalling leads to dos
https://notcve.org/view.php?id=CVE-2023-5236
28 Sep 2023 — A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service. Se encontró una falla en Infinispan, que no detecta referencias de objetos circulares al desarmar. Un atacante autenticado con permisos suficientes podría insertar un objeto construido con fines malintencionados en la memo... • https://access.redhat.com/errata/RHSA-2023:5396 • CWE-1047: Modules with Circular Dependencies •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10771 – infinispan-server-rest: Actions with effects should not be permitted via GET requests using REST API
https://notcve.org/view.php?id=CVE-2020-10771
27 May 2021 — A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack. Se ha encontrado un fallo en Infinispan versión 10, donde es posible llevar a cabo varias acciones que podrían tener efectos secundarios utilizando peticiones GET. Este fallo permite a un atacante llevar a cabo un ataque de tipo cross-site request forgery (CSRF) A flaw was found in infin... • https://bugzilla.redhat.com/show_bug.cgi?id=1846293 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-31917 – Infinispan: Authentication bypass on REST endpoints when using DIGEST authentication mechanism
https://notcve.org/view.php?id=CVE-2021-31917
27 May 2021 — A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se ha encontrado un fallo en Red Hat DataGrid versiones 8.x (8.0.0, 8.0.1, 8.1.0 y 8.1.1) e Infinispan (10.0.0 a 12.0.0). Un atacante podría omitir la autenticación en tod... • https://access.redhat.com/security/cve/cve-2021-31917 • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-25711 – infinispan: authorization check missing for server management operations
https://notcve.org/view.php?id=CVE-2020-25711
03 Dec 2020 — A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role. Se encontró un fallo en la API REST de infinispan versión 10, donde los permisos de autorización no son comprobados mientras se llevan a cabo algunas operaciones de administración del servidor. Cuando authz está habilitada, cualquier usuar... • https://bugzilla.redhat.com/show_bug.cgi?id=1897618 • CWE-862: Missing Authorization •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10746 – Infinispan: REST and HotRod APIs unsecured locally by default
https://notcve.org/view.php?id=CVE-2020-10746
19 Oct 2020 — A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server. Se encontró un fallo en la versión 10 de Infinispan (org.infinispan:infinispan-server-runtime), que permite el acceso local a los controles a través de las API REST y HotRod. E... • https://bugzilla.redhat.com/show_bug.cgi?id=1835922 • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10158 – infinispan: Session fixation protection broken for Spring Session integration
https://notcve.org/view.php?id=CVE-2019-10158
02 Dec 2019 — A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling. Se encontró un fallo en Infinispan versiones hasta la versión 9.4.14.Final. Una implementación inapropiada de la protección de fijación de sesión en la integración de Spring Session puede resultar en un manejo de sesión incorrecto. Red Hat Data Grid is a distributed, in-memory, NoSQL datastore based on the Infin... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158 • CWE-384: Session Fixation •