title: Non-admins should not be able to get cache config via rest api
description: A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
problem types: Missing Critical Step in Authentication
affected:
{
product: infinispan
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Data Grid 8.4.4
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: infinispan
cpe: cpe:/a:redhat:jboss_data_grid:8
}
{
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
packageName: infinispan
defaultStatus: unknown
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:6
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]