CVE-2018-1131GHSA-QQFC-M9HC-PQV3
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 9.3.1.Final
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Timeline
- CVE published
- Record last updated
Affected versions
- Red Hat, Inc. infinispan
9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1
- org.infinispan:infinispan-coreMaven
8.2.10.Final
- org.infinispan:infinispan-coreMaven
9.0.3.Final
- org.infinispan:infinispan-coreMaven
9.1.7.Final
- org.infinispan:infinispan-coreMaven
9.2.2.Final
- org.infinispan:infinispan-coreMaven
From 9.3.0.Alpha1 · fixed in 9.3.1.Final