{"action":"Upgrade org.infinispan:infinispan-server-rest to 14.0.18.Final (14.x) or 15.0.0.Dev04 (15.x) or later.","affected":[{"fixed":"15.0.0.Dev04","introduced":"15.0.0.Dev01"},{"fixed":"14.0.18.Final","introduced":"0"}],"component":"org.infinispan:infinispan-server-rest","cve_ids":["CVE-2023-3628"],"ecosystem":"Maven","epss":0.00797,"exploited":false,"fixed_versions":["15.0.0.Dev04","14.0.18.Final"],"ghsa_id":"GHSA-fhr7-8jx4-r9cp","id":"tcs_01M5N8W36GTKW56TS20RSWCC4Z","modified_at":"2026-09-10T03:50:04.404558922Z","published_at":"2023-12-30T00:30:23Z","references":["https://osv.dev/vulnerability/GHSA-fhr7-8jx4-r9cp","https://nvd.nist.gov/vuln/detail/CVE-2023-3628","https://github.com/infinispan/infinispan/commit/70a50352d9195753a588d0fba8c2063b99f96263","https://github.com/infinispan/infinispan/commit/b34488dcab8bdd4258972568b8405ee7111276ec","https://access.redhat.com/errata/RHSA-2023:5396","https://access.redhat.com/security/cve/CVE-2023-3628","https://bugzilla.redhat.com/show_bug.cgi?id=2217924","https://github.com/infinispan/infinispan","https://security.netapp.com/advisory/ntap-20240125-0004"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-fhr7-8jx4-r9cp","url":"https://osv.dev/vulnerability/GHSA-fhr7-8jx4-r9cp"}],"summary":"Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions"}