WaratekVRT Sign in

CVE-2023-5384 Infinispan

Affected softwareInfinispan
Severity7.2 High CVSS 3.1 2 scores
Fixed in15.0.0.Dev07, 14.0.25.Final
WeaknessCWE-312
Published18 Dec 2023
Updated17 Jun 2026

Description

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 2 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.54% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

A public code fix exists: infinispan/infinispan #11555.

  • Protection none
  • Action unverified
  • Review automated Upstream data
  • Record active
Decided by Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all
Finding This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious.
Candidate fix https://bugzilla.redhat.com/show_bug.cgi?id=2242156 : a Red Hat bug: the triage, which links onward to the fix

CVSS

7.2 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H secalert@redhat.com Secondary published
CVSS 3.1 2.7 LOW CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.infinispan:infinispan-core 15.0.0.Dev01 15.0.0.Dev07 unbounded
org.infinispan:infinispan-core 0 14.0.25.Final unbounded
org.infinispan:infinispan-commons 15.0.0.Dev01 15.0.0.Dev07 unbounded
org.infinispan:infinispan-commons 0 14.0.25.Final unbounded
org.infinispan:infinispan-hotrod 15.0.0.Dev01 15.0.0.Dev07 unbounded
org.infinispan:infinispan-hotrod 0 14.0.25.Final unbounded
org.infinispan:infinispan-client-hotrod 15.0.0.Dev01 15.0.0.Dev07 unbounded
org.infinispan:infinispan-client-hotrod 0 14.0.25.Final unbounded
org.infinispan:infinispan-cachestore-jdbc-common 15.0.0.Dev01 15.0.0.Dev07 unbounded
org.infinispan:infinispan-cachestore-jdbc-common 0 14.0.25.Final unbounded
org.infinispan:infinispan-cachestore-remote 15.0.0.Dev01 15.0.0.Dev07 unbounded
org.infinispan:infinispan-cachestore-remote 0 14.0.25.Final unbounded
org.infinispan:infinispan-cachestore-sql 15.0.0.Dev01 15.0.0.Dev07 unbounded
org.infinispan:infinispan-cachestore-sql 0 14.0.25.Final unbounded
org.infinispan:infinispan-cachestore-jdbc 15.0.0.Dev01 15.0.0.Dev07 unbounded
org.infinispan:infinispan-cachestore-jdbc 0 14.0.25.Final unbounded

Products and versions

11 products, 19 version entries
SourceVendorProductSchemeAffected versions
nvd infinispan infinispan generic any version
osv org.infinispan infinispan-cachestore-jdbc generic ＜ 14.0.25 · ≥ 15.0.0 and ＜ 15.0.0
osv org.infinispan infinispan-cachestore-jdbc-common generic ＜ 14.0.25 · ≥ 15.0.0 and ＜ 15.0.0
osv org.infinispan infinispan-cachestore-remote generic ＜ 14.0.25 · ≥ 15.0.0 and ＜ 15.0.0
osv org.infinispan infinispan-cachestore-sql generic ＜ 14.0.25 · ≥ 15.0.0 and ＜ 15.0.0
osv org.infinispan infinispan-client-hotrod generic ＜ 14.0.25 · ≥ 15.0.0 and ＜ 15.0.0
osv org.infinispan infinispan-commons generic ＜ 14.0.25 · ≥ 15.0.0 and ＜ 15.0.0
osv org.infinispan infinispan-core generic ＜ 14.0.25 · ≥ 15.0.0 and ＜ 15.0.0
osv org.infinispan infinispan-hotrod generic ＜ 14.0.25 · ≥ 15.0.0 and ＜ 15.0.0
nvd redhat data grid generic ＜ 8.4.6
nvd redhat jboss data grid generic any version

References

URLTags
https://bugzilla.redhat.com/show_bug.cgi?id=2242156 bugzilla
https://github.com/infinispan/infinispan/pull/11555 WEB
https://github.com/infinispan/infinispan/pull/11995 WEB
https://github.com/infinispan/infinispan/commit/7140fc9b026ec55786c1aa78bb3cd8bf951fad47 WEB
https://github.com/infinispan/infinispan/commit/fd3e18ec3b1a4e7fcfd79392f5bf78792a2b8c61 WEB
https://access.redhat.com/errata/RHSA-2023:7676 WEB
https://access.redhat.com/security/cve/CVE-2023-5384 WEB
https://github.com/infinispan/infinispan PACKAGE
https://issues.redhat.com/browse/ISPN-15202 WEB
https://security.netapp.com/advisory/ntap-20240125-0004 WEB

Timeline
Published2023-12-18By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.