Medium severity · published Jul 16, 2018
CVE-2017-2638
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints
6.5
CVSS
1.6%
EPSS
No
On KEV
Description
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Infinispan · Infinispan
before 9.0.0 · source: NVD
JD
Jboss Data Grid · Redhat
7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2638
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2638
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1097.html
Third Party Advisory
http://www.securityfocus.com/bid/97964
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638
Patch
https://github.com/infinispan/infinispan/pull/4936/commits
Third Party Advisory
https://issues.jboss.org/browse/ISPN-7485
More from Infinispan
9.8
CVE-2019-10158
A flaw was found in Infinispan through version 9.4.14.Final
8.8
CVE-2019-10174
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any…
8.8
CVE-2016-0750
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events
8.8
CVE-2018-1131
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations
8.8
CVE-2017-15089
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache