CVE-2018-1131

N/A

Beschreibung

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

CVE Details

CVSS v3.1 BewertungN/A

Veroffentlicht5/15/2018

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

infinispan:infinispanredhat:jboss_data_grid

Schwachen (CWE)

CWE-349CWE-502

Referenzen

http://www.securityfocus.com/bid/104218(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2018:1833(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2019:3892(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=1576492(secalert@redhat.com)

http://www.securityfocus.com/bid/104218(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1833(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:3892(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=1576492(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.