CVEvulnerability

CVE-2019-10174

8.8 HIGH Published 2019-11-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-11-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-470

Description

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

Affected configurations

• infinispan infinispan (< 8.2.12) • infinispan infinispan (>= 9.0.0 < 9.4.17) • redhat fuse 1.0 • redhat jboss data grid • redhat jboss enterprise application platform • redhat openshift application runtimes • redhat single sign-on • redhat jboss enterprise application platform 7.2 • netapp active iq unified manager

Related

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References