GitHub Advisoryadvisory · Maven

GHSA-qqfc-m9hc-pqv3 Deserialization of Untrusted Data in Infinispan

HIGH Published 2022-05-13 Modified 2022-06-29 Official page ↗
Aliases
CVE-2018-1131
Ecosystem
Maven
Packages
org.infinispan:infinispan-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-06-29

Affected packages

• Maven org.infinispan:infinispan-core: 8.2.10.Final (no fix yet) • Maven org.infinispan:infinispan-core: 9.0.3.Final (no fix yet) • Maven org.infinispan:infinispan-core: 9.1.7.Final (no fix yet) • Maven org.infinispan:infinispan-core: 9.2.2.Final (no fix yet) • Maven org.infinispan:infinispan-core: >= 9.3.0.Alpha1, < 9.3.1.Final → fixed in 9.3.1.Final

Description

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

Related

Alias · CVE (1)

  • CVE-2018-1131 Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References