Infinispan
Approved changes feed: RSS · Atom
cpe:2.3:a:infinispan:infinispan:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Infinispan (ddbd4d07-948e-53f7-b732-fa69b3776ed5) |
|---|---|
| Product | Infinispan (9b99f329-70b2-5481-a7c9-2f82fb1dc68b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/infinispan/infinispan |
purl2cpe | 2026-06-01 10:12:22.578801 |
pkg:sourceforge/infinispan |
purl2cpe | 2026-06-01 10:12:22.578802 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-5731 |
vulnerable | 2026-06-08 07:37:25.623380 |
Infinispan: credential leakage in infinispan cli
MEDIUM (5.5)
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
Published: 2025-06-26T21:28:59.501Z
Updated: 2026-01-08T03:11:10.828Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5384 |
vulnerable | 2026-06-08 06:19:43.492857 |
Infinispan: credentials returned from configuration as clear text
HIGH (7.2)
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Published: 2023-12-18T13:43:08.728Z
Updated: 2025-11-20T07:07:36.736Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5236 |
vulnerable | 2026-06-08 06:19:42.955113 |
Infinispan: circular reference on marshalling leads to dos
MEDIUM (4.4)
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
Published: 2023-12-18T13:43:08.445Z
Updated: 2025-11-21T05:57:06.838Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3629 |
vulnerable | 2026-06-08 06:09:40.040576 |
Infinispan: non-admins should not be able to get cache config via rest api
MEDIUM (4.3)
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Published: 2023-12-18T13:43:07.770Z
Updated: 2025-11-07T10:41:28.830Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3628 |
vulnerable | 2026-06-08 06:09:40.039929 |
Infispan: rest bulk ops don't check permissions
MEDIUM (6.5)
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
Published: 2023-12-18T13:43:07.750Z
Updated: 2025-11-07T10:41:24.777Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.