CVE-2017-2638
16.07.2018, 13:29
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.Enginsight
| Vendor | Product | Version |
|---|---|---|
| infinispan | infinispan | 𝑥 < 9.0.0 |
| redhat | jboss_data_grid | 7.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-306 - Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-287 - Improper AuthenticationWhen an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
References