# org.infinispan:infinispan-core (Maven) vulnerabilities

7 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.infinispan/infinispan-core

## Advisories (7)

### [CVE-2023-5384](https://cve.now/CVE-2023-5384): Infinispan: credentials returned from configuration as clear text

- Severity: High 7.2
- Published: Dec 18, 2023
- Affected: from 15.0.0.Dev01, fixed in 15.0.0.Dev07; fixed in 14.0.25.Final.

### [CVE-2020-25711](https://cve.now/CVE-2020-25711): A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management…

- Severity: Unrated
- Published: Dec 3, 2020
- Affected: fixed in 11.0.6.Final.

### [CVE-2019-10158](https://cve.now/CVE-2019-10158): A flaw was found in Infinispan through version 9.4.14.Final.

- Severity: Medium 5.4
- Published: Jan 2, 2020
- Affected: fixed in 9.4.15.Final.

### [CVE-2019-10174](https://cve.now/CVE-2019-10174): A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application…

- Severity: High 7.5
- Published: Nov 25, 2019
- Affected: fixed in 8.2.12.Final; from 9.0.0.Final, fixed in 9.4.17.Final.

### [CVE-2016-0750](https://cve.now/CVE-2016-0750): The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.

- Severity: Medium 4.2
- Published: Sep 11, 2018
- Affected: fixed in 9.1.0.Final.

### [CVE-2018-1131](https://cve.now/CVE-2018-1131): Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.

- Severity: Unrated
- Published: May 15, 2018
- Affected: versions 8.2.10.Final; versions 9.0.3.Final; versions 9.1.7.Final; versions 9.2.2.Final; from 9.3.0.Alpha1, fixed in 9.3.1.Final.

### [CVE-2017-15089](https://cve.now/CVE-2017-15089): It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache.

- Severity: Unrated
- Published: Feb 15, 2018
- Affected: fixed in 9.2.0.CR1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.infinispan:infinispan-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.