Infinispan: credentials returned from configuration as clear text
Priority LOW 34CWE-312Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-312.
Summary
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00543 45th percentileScored 2026-11-07
Fix Fixed org.infinispan:infinispan-core (Maven): 15.0.0.Dev07, 14.0.25.Finalorg.infinispan:infinispan-commons (Maven): 15.0.0.Dev07, 14.0.25.Final+6 more productsRed Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Data Grid 8.4.6 | — | — | Not affected | CNA |
| — | org.infinispan:infinispan-core (Maven) | 15.0.0.Dev01 to before 15.0.0.Dev07 | 15.0.0.Dev07 | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-core (Maven) | before 14.0.25.Final | 14.0.25.Final | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-commons (Maven) | 15.0.0.Dev01 to before 15.0.0.Dev07 | 15.0.0.Dev07 | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-commons (Maven) | before 14.0.25.Final | 14.0.25.Final | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-hotrod (Maven) | 15.0.0.Dev01 to before 15.0.0.Dev07 | 15.0.0.Dev07 | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-hotrod (Maven) | before 14.0.25.Final | 14.0.25.Final | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-client-hotrod (Maven) | 15.0.0.Dev01 to before 15.0.0.Dev07 | 15.0.0.Dev07 | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-client-hotrod (Maven) | before 14.0.25.Final | 14.0.25.Final | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-cachestore-jdbc-common (Maven) | 15.0.0.Dev01 to before 15.0.0.Dev07 | 15.0.0.Dev07 | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-cachestore-jdbc-common (Maven) | before 14.0.25.Final | 14.0.25.Final | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-cachestore-remote (Maven) | 15.0.0.Dev01 to before 15.0.0.Dev07 | 15.0.0.Dev07 | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-cachestore-remote (Maven) | before 14.0.25.Final | 14.0.25.Final | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-cachestore-sql (Maven) | 15.0.0.Dev01 to before 15.0.0.Dev07 | 15.0.0.Dev07 | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-cachestore-sql (Maven) | before 14.0.25.Final | 14.0.25.Final | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-cachestore-jdbc (Maven) | 15.0.0.Dev01 to before 15.0.0.Dev07 | 15.0.0.Dev07 | Patch available | GHSA-gg57-587f-h5v6 |
| — | org.infinispan:infinispan-cachestore-jdbc (Maven) | before 14.0.25.Final | 14.0.25.Final | Patch available | GHSA-gg57-587f-h5v6 |
- Red Hat Data Grid 8.4.6 VendorRed Hat Affected — Fixed in — Not affected CNA
- org.infinispan:infinispan-core (Maven) Vendor— Affected 15.0.0.Dev01 to before 15.0.0.Dev07 Fixed in 15.0.0.Dev07 Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-core (Maven) Vendor— Affected before 14.0.25.Final Fixed in 14.0.25.Final Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-commons (Maven) Vendor— Affected 15.0.0.Dev01 to before 15.0.0.Dev07 Fixed in 15.0.0.Dev07 Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-commons (Maven) Vendor— Affected before 14.0.25.Final Fixed in 14.0.25.Final Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-hotrod (Maven) Vendor— Affected 15.0.0.Dev01 to before 15.0.0.Dev07 Fixed in 15.0.0.Dev07 Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-hotrod (Maven) Vendor— Affected before 14.0.25.Final Fixed in 14.0.25.Final Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-client-hotrod (Maven) Vendor— Affected 15.0.0.Dev01 to before 15.0.0.Dev07 Fixed in 15.0.0.Dev07 Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-client-hotrod (Maven) Vendor— Affected before 14.0.25.Final Fixed in 14.0.25.Final Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-cachestore-jdbc-common (Maven) Vendor— Affected 15.0.0.Dev01 to before 15.0.0.Dev07 Fixed in 15.0.0.Dev07 Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-cachestore-jdbc-common (Maven) Vendor— Affected before 14.0.25.Final Fixed in 14.0.25.Final Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-cachestore-remote (Maven) Vendor— Affected 15.0.0.Dev01 to before 15.0.0.Dev07 Fixed in 15.0.0.Dev07 Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-cachestore-remote (Maven) Vendor— Affected before 14.0.25.Final Fixed in 14.0.25.Final Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-cachestore-sql (Maven) Vendor— Affected 15.0.0.Dev01 to before 15.0.0.Dev07 Fixed in 15.0.0.Dev07 Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-cachestore-sql (Maven) Vendor— Affected before 14.0.25.Final Fixed in 14.0.25.Final Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-cachestore-jdbc (Maven) Vendor— Affected 15.0.0.Dev01 to before 15.0.0.Dev07 Fixed in 15.0.0.Dev07 Patch available GHSA-gg57-587f-h5v6
- org.infinispan:infinispan-cachestore-jdbc (Maven) Vendor— Affected before 14.0.25.Final Fixed in 14.0.25.Final Patch available GHSA-gg57-587f-h5v6
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:data_grid:*:*:*:*:*:*:*:* | before 8.4.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:infinispan:infinispan:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Infinispan |
- cpe:2.3:a:redhat:data_grid:*:*:*:*:*:*:*:* Versions before 8.4.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:infinispan:infinispan:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Infinispan
Remediation
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-core (Maven) Fixed in 15.0.0.Dev07 Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-core (Maven) Fixed in 14.0.25.Final Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-commons (Maven) Fixed in 15.0.0.Dev07 Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-commons (Maven) Fixed in 14.0.25.Final Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-hotrod (Maven) Fixed in 15.0.0.Dev07 Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-hotrod (Maven) Fixed in 14.0.25.Final Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-client-hotrod (Maven) Fixed in 15.0.0.Dev07 Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-client-hotrod (Maven) Fixed in 14.0.25.Final Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-cachestore-jdbc-common (Maven) Fixed in 15.0.0.Dev07 Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-cachestore-jdbc-common (Maven) Fixed in 14.0.25.Final Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-cachestore-remote (Maven) Fixed in 15.0.0.Dev07 Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-cachestore-remote (Maven) Fixed in 14.0.25.Final Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-cachestore-sql (Maven) Fixed in 15.0.0.Dev07 Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-cachestore-sql (Maven) Fixed in 14.0.25.Final Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-cachestore-jdbc (Maven) Fixed in 15.0.0.Dev07 Advisory →
- Fix · GHSA-gg57-587f-h5v6 org.infinispan:infinispan-cachestore-jdbc (Maven) Fixed in 14.0.25.Final Advisory →
Red Hat 1 advisory
- RHSA-2023:7676 Released 2023-12-06 · Red Hat rating ImportantRed Hat Data Grid 8.4.6 security update
- Red Hat Data Grid 8.4.6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8.4.6 | Fixed | RHSA-2023:7676 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5384
- 2026-10-03 Alias added: GHSA-gg57-587f-h5v6
References
Advisory 3
Other 8
- RHBZ#2242156
- https://github.com/infinispan/infinispan/pull/11555
- https://github.com/infinispan/infinispan/pull/11995
- https://github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47
- https://github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61
- https://github.com/infinispan/infinispan
- https://issues.redhat.com/browse/ISPN-15202
- https://security.netapp.com/advisory/ntap-20240125-0004
More Red Hat Data Grid vulnerabilities
- TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
- TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
- TI-2026-32429 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVSS 3.1HIGH 7.7
- TI-2021-11905 Improper authentication in Red Hat DataGrid and Infinispan CVSS 3.1CRITICAL 9.8
- TI-2026-22645 Undertow: undertow: request smuggling via inconsistent header parsing CVSS 3.1CRITICAL 9.1
- TI-2026-22646 Undertow: undertow: request smuggling via malformed http request headers CVSS 3.1CRITICAL 9.1
Sources
- CVE-2023-5384 · CVE Program
- CVE-2023-5384 · NVD
- FIRST EPSS
- GHSA-gg57-587f-h5v6 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-5384 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences