CVE-2025-0736 Org.infinispan-infinispan-parent: exposure of sensitive information in application logs
Attackers can read sensitive configuration details or credentials from application logs when using JGroups with JDBC_PING in Infinispan.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0736?
CVE-2025-0736 is a medium-severity vulnerability in Red Hat Data Grid, published on 28 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors.
Weakness: CWE-532
Which versions are affected by CVE-2025-0736?
2 open source packages ship an affected version, including org.infinispan:infinispan-parent.
| Package | Affected | Fixed in |
|---|---|---|
org.infinispan:infinispan-parent Maven | All versions to 15.1.4.Final | None |
org.infinispan:infinispan-parent Maven | All versions to 15.1.4.Final | None |
How do I fix CVE-2025-0736?
No fix has been published for CVE-2025-0736 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0736 being exploited?
There is no known exploitation of CVE-2025-0736 in the wild and no public exploit code.
Sources
Also known as GHSA-269m-c36j-r834.