CVE-2017-2638

NONE EPSS 72.2%

Published Jul 16, 20187y ago · Modified Jun 17, 20262w ago

Published Jul 16, 2018 7y ago

Last Modified Jun 17, 2026 2w ago

Description

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.

Threat Intelligence

EPSS Exploit Probability

72.2% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 2

CWE-287 Improper Authentication Authentication

CWE-306 Missing Authentication for Critical Function Authentication

Affected Products 2

Vendor	Product	Version	Range
infinispan	infinispan	*	<9.0.0
redhat	jboss_data_grid	7.1	any

References 5

rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2017-1097.html

Third Party Advisory
securityfocus.com http://www.securityfocus.com/bid/97964

Third Party AdvisoryVDB Entry
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638

Issue TrackingPatchThird Party Advisory
github.com https://github.com/infinispan/infinispan/pull/4936/commits

PatchThird Party Advisory
issues.jboss.org https://issues.jboss.org/browse/ISPN-7485

Third Party Advisory

Remediation

bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638

Issue TrackingPatchThird Party Advisory
github.com https://github.com/infinispan/infinispan/pull/4936/commits

PatchThird Party Advisory