CVE-2017-2638 Infinispan Rest API Does Not Enforce Auth Constraints
MediumCVSS 6.5
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.infinispan/infinispan-server-core(Maven) | < 9.0.0 | 9.0.0 |
| org.infinispan/infinispan-server-core(Maven) | = 5.0.0.FINAL | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.0.1.FINAL | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.ALPHA1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.ALPHA2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.BETA1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.BETA2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.BETA3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.BETA4 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.BETA5 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.CR2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.CR3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.CR4 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.0.FINAL | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.1.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.1.FINAL | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.2.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.2.FINAL | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.3.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.3.FINAL | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.4.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.4.FINAL | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.5.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.5.FINAL | No fix listed |
Show 133 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.infinispan/infinispan-server-core(Maven) | = 5.1.6.FINAL | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.7.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.1.8.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.ALPHA1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.ALPHA2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Beta3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Beta4 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Beta5 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Beta6 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.CR2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.CR3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.1.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.10.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.11.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.11.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.12.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.13.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.14.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.15.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.18.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.19.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.2.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.20.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.3.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.4.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.5.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.6.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.7.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.8.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.8.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.2.9.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.3.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.3.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.3.0.Beta2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.3.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.3.0.CR2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 5.3.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.1.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 6.0.2.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.Alpha5 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.CR2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.1.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.2.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.0.3.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.1.0.CR2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.1.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.1.1.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.1.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.2.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.3.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.4.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 7.2.5.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.0.Beta3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.1.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.0.2.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.1.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.2.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.3.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.4.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.5.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.6.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.7.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.8.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.1.9.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.0.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.1.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.10.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.11.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.12.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.2.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.3.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.4.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.5.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.6.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.7.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 8.2.8.Final | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.CR2 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.CR3 | No fix listed |
| org.infinispan/infinispan-server-core(Maven) | = 9.0.0.CR4 | No fix listed |
| infinispan | < 9.0.0 | 9.0.0 |
| redhat jboss data grid | = 7.1 | No fix listed |
| [UNKNOWN] infinispan | = Infinispan 9.0.0.Final | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- issues.jboss.org third-party-advisory
- RHSA-2017:1097 third-party-advisory vendor-advisory
- 97964 third-party-advisory vdb-entry
- github.com patch
- github.com
- github.com patch third-party-advisory