CVE-2023-5384: infinispan
CVSS: 7.2v3.1HighModified
AliasesCGA-3mqr-5pjm-p9h8CGA-4p3p-wwhx-fm97CGA-g95p-3vm7-mp6xGHSA-gg57-587f-h5v6CGA-qmf9-2g54-mrgwCGA-rj2r-wv8q-jhw6CGA-x7ww-jfq3-mxgc
Published 18-12-2023Last modified 20-11-2025
Vulnerability summary
CVE-2023-5384 is a high (CVSS 7.2) vulnerability in infinispan. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.4% of scored vulnerabilities.
CVSS score
7.2/10
010
High · v3.1 (CVE.org)EPSS score
0.54%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 18-12-2023PublishedVulnerability first disclosed.
- 20-11-2025Last modifiedVulnerability information updated.
Description
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 5.1Preferred score · OSV · Maven (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 7.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSources4 sources · 2.7–7.2
- OSV · ChainguardEcosystem advisory · calculated2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · MavenEcosystem advisory · calculated2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
- NVDNIST2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
0.00 pp
From 0.54% on 19-09-2026
19-09-202619-10-2026
EPSS score0.54%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Org.infinispan8 products
- infinispan-cachestore-jdbc≥ 15.0.0.Dev01, < 15.0.0.Dev07 | < 14.0.25.Final
- infinispan-cachestore-jdbc-common≥ 15.0.0.Dev01, < 15.0.0.Dev07 | < 14.0.25.Final
- infinispan-cachestore-remote≥ 15.0.0.Dev01, < 15.0.0.Dev07 | < 14.0.25.Final
- infinispan-cachestore-sql≥ 15.0.0.Dev01, < 15.0.0.Dev07 | < 14.0.25.Final
- infinispan-client-hotrod≥ 15.0.0.Dev01, < 15.0.0.Dev07 | < 14.0.25.Final
Chainguard3 products
- infinispan-15.0< 15.0.21-r1
- infinispan-15.1< 15.1.7-r3
- infinispan-15.2< 15.2.6-r1
Redhat2 products
- data_grid< 8.4.6
- jboss_data_gridna
Infinispan1 product
4 vendors · 14 products
