A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
DescriptionDhananjay Arunesh
2023-06-27 13:41:25 UTC
The REST bulk read endpoints:
/rest/v2/caches/{cacheName}?action=keys
/rest/v2/caches/{cacheName}?action=entries
use the cluster publisher, which is an internal component which doesn't check that the subject has bulk read permissions
The methods require authentication, but once authenticated, any user can invoke them successfully.
The REST bulk read endpoints: /rest/v2/caches/{cacheName}?action=keys /rest/v2/caches/{cacheName}?action=entries use the cluster publisher, which is an internal component which doesn't check that the subject has bulk read permissions The methods require authentication, but once authenticated, any user can invoke them successfully.