CVE-2018-1131

State: Published
Severity: Not scored
Published: May 15, 2018
Updated: Sep 16, 2024
Reserved: Dec 4, 2017

Description

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

Scores

The record has no CVSS score.

Weaknesses

CWE-349

Affected Products

Product	Versions
infinispanRed Hat, Inc.	9.0.3.FinalAffected 9.1.7.FinalAffected 8.2.10.FinalAffected 9.2.2.FinalAffected 9.3.0.Alpha1Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1576492
104218vdb-entry
RHSA-2018:1833vendor-advisory
RHSA-2019:3892vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.