CVE-2018-1131

N/A

Description

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

CVE Details

CVSS v3.1 ScoreN/A

Published5/15/2018

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

infinispan:infinispanredhat:jboss_data_grid

Weaknesses (CWE)

CWE-349CWE-502

References

http://www.securityfocus.com/bid/104218(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2018:1833(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2019:3892(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=1576492(secalert@redhat.com)

http://www.securityfocus.com/bid/104218(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1833(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2019:3892(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=1576492(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.