Infinispan Rest API Does Not Enforce Auth Constraints
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-2638US | medium6.5OT elevated | — | ||
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the… | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2017-1097.htmlWEB
- http://www.securityfocus.com/bid/97964WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638WEB
- https://github.com/infinispan/infinispan/pull/4936WEB
- https://issues.jboss.org/browse/ISPN-7485WEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-2638ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan