CVE-2016-0750
11.09.2018, 13:29
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.Enginsight
| Vendor | Product | Version |
|---|---|---|
| infinispan | infinispan | 𝑥 < 9.1.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-138 - Improper Neutralization of Special ElementsThe software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
- CWE-502 - Deserialization of Untrusted DataThe application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
References