CVE-2023-5384 json
Infinispan: credentials returned from configuration as clear text
published 2023-12-18 2 y ago modified 2026-09-10 1 mo ago also EUVD-2023-3210 , GHSA-gg57-587f-h5v6
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Patch / fix
- maven org.infinispan:infinispan-core 14.0.25.Final, 15.0.0.Dev07
- maven org.infinispan:infinispan-commons 14.0.25.Final, 15.0.0.Dev07
- maven org.infinispan:infinispan-hotrod 14.0.25.Final, 15.0.0.Dev07
- maven org.infinispan:infinispan-client-hotrod 14.0.25.Final, 15.0.0.Dev07
- maven org.infinispan:infinispan-cachestore-jdbc-common 14.0.25.Final, 15.0.0.Dev07
- maven org.infinispan:infinispan-cachestore-remote 14.0.25.Final, 15.0.0.Dev07
- maven org.infinispan:infinispan-cachestore-sql 14.0.25.Final, 15.0.0.Dev07
- maven org.infinispan:infinispan-cachestore-jdbc 14.0.25.Final, 15.0.0.Dev07
- infinispan infinispan-core 14.0.18.Final, 15.0.0.Dev04
- infinispan infinispan 14.0.18.Final, 15.0.0.Dev04
- org.infinispan infinispan-core 14.0.18.Final, 15.0.0.Dev04
- infinispan infinispan-commons 14.0.18.Final, 15.0.0.Dev04
- org.infinispan infinispan-commons 14.0.18.Final, 15.0.0.Dev04
- infinispan infinispan-hotrod 14.0.18.Final, 15.0.0.Dev04
- org.infinispan infinispan-hotrod 14.0.18.Final, 15.0.0.Dev04
- infinispan infinispan-client-hotrod 14.0.18.Final, 15.0.0.Dev04
- org.infinispan infinispan-client-hotrod 14.0.18.Final, 15.0.0.Dev04
- infinispan infinispan-cachestore-sql 14.0.18.Final, 15.0.0.Dev04
- org.infinispan infinispan-cachestore-sql 14.0.18.Final, 15.0.0.Dev04
- infinispan infinispan-cachestore-remote 14.0.18.Final, 15.0.0.Dev04
- org.infinispan infinispan-cachestore-remote 14.0.18.Final, 15.0.0.Dev04
- infinispan infinispan-cachestore-jdbc-common 14.0.18.Final, 15.0.0.Dev04
- org.infinispan infinispan-cachestore-jdbc-common 14.0.18.Final, 15.0.0.Dev04
- infinispan infinispan-cachestore-jdbc 14.0.18.Final, 15.0.0.Dev04
- org.infinispan infinispan-cachestore-jdbc 14.0.18.Final, 15.0.0.Dev04
- redhat data_grid 8.4.6
- github.com/infinispan/infinispan@7140fc9 commit
- github.com/infinispan/infinispan@fd3e18e commit
- github.com/infinispan/infinispan#11555 pull request
- github.com/infinispan/infinispan#11995 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-5384 updated cvss 7.2
infinispan: Credentials returned from configuration as clear text
-
Red Hat Data Grid 8.4.6fixed: vendor fix RHSA-2023:7676
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.infinispan:infinispan-core | >=15.0.0.Dev01, <15.0.0.Dev07 <14.0.25.Final |
15.0.0.Dev07 14.0.25.Final |
| maven | org.infinispan:infinispan-commons | >=15.0.0.Dev01, <15.0.0.Dev07 <14.0.25.Final |
15.0.0.Dev07 14.0.25.Final |
| maven | org.infinispan:infinispan-hotrod | >=15.0.0.Dev01, <15.0.0.Dev07 <14.0.25.Final |
15.0.0.Dev07 14.0.25.Final |
| maven | org.infinispan:infinispan-client-hotrod | >=15.0.0.Dev01, <15.0.0.Dev07 <14.0.25.Final |
15.0.0.Dev07 14.0.25.Final |
| maven | org.infinispan:infinispan-cachestore-jdbc-common | >=15.0.0.Dev01, <15.0.0.Dev07 <14.0.25.Final |
15.0.0.Dev07 14.0.25.Final |
| maven | org.infinispan:infinispan-cachestore-remote | >=15.0.0.Dev01, <15.0.0.Dev07 <14.0.25.Final |
15.0.0.Dev07 14.0.25.Final |
| maven | org.infinispan:infinispan-cachestore-sql | >=15.0.0.Dev01, <15.0.0.Dev07 <14.0.25.Final |
15.0.0.Dev07 14.0.25.Final |
| maven | org.infinispan:infinispan-cachestore-jdbc | >=15.0.0.Dev01, <15.0.0.Dev07 <14.0.25.Final |
15.0.0.Dev07 14.0.25.Final |
Affected products
- Red Hat Red Hat Data Grid 8.4.6
Classification
- Weakness
-
- CWE-312 Cleartext Storage of Sensitive Information
References
-
github.com
/infinispan/infinispan/pull/11555
web
-
github.com
/infinispan/infinispan/pull/11995
web
-
github.com
/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47
web
-
github.com
/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61
web
-
access.redhat.com
/errata/RHSA-2023:7676
vendor-advisory, web
-
access.redhat.com
/security/cve/CVE-2023-5384
vdb-entry, web, vendor-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2242156
issue-tracking, web
- security.netapp.com /advisory/ntap-20240125-0004/
-
nvd.nist.gov
/vuln/detail/CVE-2023-5384
advisory
-
github.com
/infinispan/infinispan
package
-
issues.redhat.com
/browse/ISPN-15202
web
-
security.netapp.com
/advisory/ntap-20240125-0004
web
Sources
- CVE List CVE-2023-5384
- GitHub Advisory GHSA-gg57-587f-h5v6
- NVD CVE-2023-5384
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Add correct affected ranges per https://github.com/advisories/GHSA-gg57-587f-h5v6.