PT-2023-32082 · Unknown · Infinispan

Patrick Del Bello · Published 2023-12-18 · Updated 2024-09-16 · CVE-2023-5384

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Infinispan (affected versions not specified)

Description A flaw was found in the serialization of cache configurations to XML, JSON, or YAML formats, which can contain credentials such as those used in JDBC stores with connection pooling or remote stores. These credentials are returned in clear text as part of the configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-5384

GHSA-GG57-587F-H5V6

Affected Products

Infinispan

References · 16

• https://access.redhat.com/errata/RHSA-2023:7676 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5384 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-5384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5384 · Security Note
• https://osv.dev/vulnerability/GHSA-gg57-587f-h5v6 · Vendor Advisory
• https://github.com/infinispan/infinispan · Note
• https://github.com/infinispan/infinispan/pull/11555 · Note
• https://github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47 · Note
• https://github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61 · Note
• https://github.com/infinispan/infinispan/pull/11995 · Note
• https://issues.redhat.com/browse/ISPN-15202 · Note
• https://t.me/cvenotify/65496 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240125-0004 · Note
• https://t.me/cvenotify/68663 · Telegram Post
• https://twitter.com/cracbot/status/1737196573287666125 · Twitter Post