GitHub Advisoryadvisory · Maven

GHSA-h47x-2j37-fw5m Use of Externally-Controlled Input to Select Classes or Code in Infinispan

HIGH Published 2022-05-24 Modified 2022-06-29 Official page ↗
Aliases
CVE-2019-10174
Ecosystem
Maven
Packages
org.infinispan:infinispan-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-470
Reviewed
2022-06-29

Affected packages

• Maven org.infinispan:infinispan-core: < 8.2.12.Final → fixed in 8.2.12.Final • Maven org.infinispan:infinispan-core: >= 9.0.0.Final, < 9.4.17.Final → fixed in 9.4.17.Final

Description

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

Related

Alias · CVE (1)

  • CVE-2019-10174 A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application… vulnerability

Weakness · CWE (1)

  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code weakness

References