Moole Vulnerability Database

Find real vulnerabilities before they ship

Low

CVE-2023-5384

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

VectorNETWORK

PublishedDec 18, 2023, 14:15

Published Bysecalert@redhat.com

Base Score

Score2.7

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.infinispan:infinispan-core(Maven)15.0.0.Dev0115.0.0.Dev07N/A

org.infinispan:infinispan-core(Maven)014.0.25.FinalN/A

org.infinispan:infinispan-commons(Maven)15.0.0.Dev0115.0.0.Dev07N/A

org.infinispan:infinispan-commons(Maven)014.0.25.FinalN/A

org.infinispan:infinispan-hotrod(Maven)15.0.0.Dev0115.0.0.Dev07N/A

org.infinispan:infinispan-hotrod(Maven)014.0.25.FinalN/A

org.infinispan:infinispan-client-hotrod(Maven)15.0.0.Dev0115.0.0.Dev07N/A

org.infinispan:infinispan-client-hotrod(Maven)014.0.25.FinalN/A

org.infinispan:infinispan-cachestore-jdbc-common(Maven)15.0.0.Dev0115.0.0.Dev07N/A

org.infinispan:infinispan-cachestore-jdbc-common(Maven)014.0.25.FinalN/A

org.infinispan:infinispan-cachestore-remote(Maven)15.0.0.Dev0115.0.0.Dev07N/A

org.infinispan:infinispan-cachestore-remote(Maven)014.0.25.FinalN/A

org.infinispan:infinispan-cachestore-sql(Maven)15.0.0.Dev0115.0.0.Dev07N/A

org.infinispan:infinispan-cachestore-sql(Maven)014.0.25.FinalN/A

org.infinispan:infinispan-cachestore-jdbc(Maven)15.0.0.Dev0115.0.0.Dev07N/A

org.infinispan:infinispan-cachestore-jdbc(Maven)014.0.25.FinalN/A

References

Weakness Type

CWE-312

CVSS Metrics

Base Score

2.7

Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Base SeverityLow

Version

3.1

Attack Vector (AV)

NETWORK

CVE-2023-5384

VectorNETWORK

PublishedDec 18, 2023, 14:15

Published Bysecalert@redhat.com