Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2023-3628 is a medium-severity Missing Critical Step in Authentication (CWE-304) vulnerability in Redhat Jboss Data Grid. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-3198
Vulnerability Data
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 6 hardening rules · 2 OS baselines
V7.2.4
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures the authentication process is followed for non-organizational users, avoiding missing critical steps.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates secure authentication mechanisms, explicitly addressing missing steps in authentication flows.
Directly requires secure management of authentication credentials and processes, preventing skipped critical steps.
Secure development lifecycle can catch missing auth steps during design, but does not directly enforce runtime authentication.
Application security requirements may specify complete auth flows, but the control itself is broader.
Secure coding practices can prevent missing auth steps, yet the control is not specific to authentication.
Limits access based on proper authentication; incomplete auth weakens the restriction.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. via CWE-304