CVE-2017-2638

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jul 16, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26397.5It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and CVE-2017-26409.8An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially useCVE-2017-26419.8In Moodle 2.x and 3.x, SQL injection can occur via user preferences.CVE-2017-26426.5Moodle 3.x has user fullname disclosure on the user preferences page.CVE-2017-26435.3In Moodle 3.2.x, global search displays user names for unauthenticated users.CVE-2017-26446.1In Moodle 3.x, XSS can occur via evidence of prior learning.CVE-2017-26456.1In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.CVE-2017-26467.5It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParCVE-2017-26477.8The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer derefereCVE-2017-26485.6It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle atCVE-2017-26498.1It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active DirectorCVE-2017-26508.5It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM comm