title: Infinispan: credentials returned from configuration as clear text
description: A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
problem types: Cleartext Storage of Sensitive Information
affected:
{
product: infinispan
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Data Grid 8.4.6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
defaultStatus: unaffected
packageName: infinispan
cpe: cpe:/a:redhat:jboss_data_grid:8
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: The issue's impact is limited because only users with administrator permissions can retrieve the cache configurations, and the recommended approach for connecting via JDBC is using the `datasource` configuration, which does not expose the database credentials.