CVE-2017-2638

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306 CWE-287

Affected software

Vendor	Product	Versions
[UNKNOWN]	infinispan	Infinispan 9.0.0.Final

References

http://rhn.redhat.com/errata/RHSA-2017-1097.htmlThird Party Advisory
http://www.securityfocus.com/bid/97964Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638Issue Tracking, Patch, Third Party Advisory
https://github.com/infinispan/infinispan/pull/4936/commitsPatch, Third Party Advisory
https://issues.jboss.org/browse/ISPN-7485Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1097.htmlThird Party Advisory
http://www.securityfocus.com/bid/97964Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2638Issue Tracking, Patch, Third Party Advisory
https://github.com/infinispan/infinispan/pull/4936/commitsPatch, Third Party Advisory
https://issues.jboss.org/browse/ISPN-7485Third Party Advisory

Timeline

Published: Jul 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-26397.5It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and CVE-2017-26409.8An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content. A malicious remote server could potentially use CVE-2017-26419.8In Moodle 2.x and 3.x, SQL injection can occur via user preferences.CVE-2017-26426.5Moodle 3.x has user fullname disclosure on the user preferences page.CVE-2017-26435.3In Moodle 3.2.x, global search displays user names for unauthenticated users.CVE-2017-26446.1In Moodle 3.x, XSS can occur via evidence of prior learning.CVE-2017-26456.1In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.CVE-2017-26467.5It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestPar CVE-2017-26477.8The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service (NULL pointer derefere CVE-2017-26485.6It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle at CVE-2017-26498.1It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active Director CVE-2017-26508.5It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM comm