Description
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Remediation
References
http://rhn.redhat.com/errata/RHSA-2017-1097.html
http://www.securityfocus.com/bid/97964
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638
https://github.com/infinispan/infinispan/pull/4936/commits
https://issues.jboss.org/browse/ISPN-7485
Related Vulnerabilities
CVE-2019-10754 Vulnerability in maven package org.apereo.cas:cas-server-core-services-api
CVE-2019-20174 Vulnerability in maven package org.webjars.npm:auth0-lock
CVE-2016-10735 Vulnerability in npm package bootstrap-sass
CVE-2021-26544 Vulnerability in maven package org.apache.livy:livy-server
CVE-2023-29924 Vulnerability in maven package tech.powerjob:powerjob