CVE-2018-1131
15.05.2018, 13:29
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.Enginsight
| Vendor | Product | Version |
|---|---|---|
| infinispan | infinispan | 8.2.10 |
| infinispan | infinispan | 9.0.3 |
| infinispan | infinispan | 9.1.7 |
| infinispan | infinispan | 9.2.2 |
| infinispan | infinispan | 9.3.0:alpha1 |
| redhat | jboss_data_grid | 7.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted DataThe software, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
- CWE-502 - Deserialization of Untrusted DataThe application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
References