CVE-2023-3629: 
Java vulnerability analysis and mitigation

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This vulnerability, identified as CVE-2023-3629, affects Infinispan's REST API and could allow an authenticated user to access information outside of their intended permissions (CVE Details, NVD).

The vulnerability exists in the REST endpoint functionality for retrieving cache configurations. Specifically, the endpoints GET /rest/v2/caches/{cacheName}?action=config and GET /rest/v2/caches do not properly check for ADMIN permissions. While these methods require authentication, any authenticated user can invoke them successfully. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Red Hat Bugzilla).

The vulnerability could expose sensitive information as the cache configuration may contain details about filesystem paths and allowed security roles which should not be viewable by non-administrators. This allows authenticated users to access information beyond their intended permissions (Red Hat Advisory).

The vulnerability has been fixed in Red Hat Data Grid 8.4.4. Organizations using affected versions should upgrade to this version or later to address the security issue (Red Hat Advisory).