CVE-2023-3628: 
Java vulnerability analysis and mitigation

A vulnerability was identified in Infinispan's REST interface (CVE-2023-3628) where bulk read endpoints fail to properly evaluate user permissions for operations. The vulnerability was discovered and disclosed in June 2023, affecting Infinispan's REST interface and related products such as Red Hat Data Grid (Red Hat Advisory, NVD).

The vulnerability specifically affects REST bulk read endpoints '/rest/v2/caches/{cacheName}?action=keys' and '/rest/v2/caches/{cacheName}?action=entries'. These endpoints use a cluster publisher, an internal component that doesn't verify subject permissions for bulk read operations. While the methods require authentication, they fail to properly validate user permissions after authentication. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Red Hat Advisory, Bugzilla).

When exploited, this vulnerability allows authenticated users to access information outside of their intended permissions. The impact is primarily focused on confidentiality, with no direct effect on integrity or availability of the system (NVD, NetApp Advisory).

Red Hat has addressed this vulnerability in Red Hat Data Grid 8.4.4 through the security advisory RHSA-2023:5396. Users are advised to upgrade to this version to mitigate the vulnerability (Red Hat Advisory).