GHSA-269m-c36j-r834

ghsaUSosv

Infinispan vulnerable to Insertion of Sensitive Information into Log File

view advisory published 2025-01-28Licence: CC-BY-4.0

A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-0736US	—	0.21% (11th)	—	2025-01-28
A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details…

references

External citations — patches, advisories, analysis.

https://access.redhat.com/errata/RHSA-2025:2663WEB
https://access.redhat.com/security/cve/CVE-2025-0736WEB
https://bugzilla.redhat.com/show_bug.cgi?id=2342233WEB
https://github.com/infinispan/infinispanPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2025-0736ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan