CVE-2023-5384: 
Java vulnerability analysis and mitigation

A vulnerability was identified in Infinispan (CVE-2023-5384) where credentials are exposed in clear text when serializing cache configurations. The issue affects configurations containing credentials for JDBC store with connection pooling and remote store when serialized to XML, JSON, or YAML formats. This vulnerability was discovered and disclosed in December 2023 (NVD, Red Hat).

The vulnerability is classified with a CVSS v3.1 base score of 2.7 (LOW) according to NVD, with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. However, Red Hat assessed it with a higher severity score of 7.2 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is categorized under CWE-312 (Cleartext Storage of Sensitive Information) (NVD).

The primary impact of this vulnerability is the exposure of sensitive credentials in clear text when cache configurations are serialized. This affects configurations containing JDBC store credentials with connection pooling and remote store settings. The impact is somewhat limited as only users with ADMIN permissions can retrieve the cache configurations (Red Hat Bugzilla).

Red Hat has addressed this vulnerability in Red Hat Data Grid 8.4.6, released through RHSA-2023:7676. Users are advised to upgrade to this version to mitigate the vulnerability (Red Hat Advisory).