CVE-2018-1131
NONE EPSS 66.2%
Published May 15, 20188y ago · Modified Jun 17, 20262w ago
Published May 15, 2018 8y ago
Last Modified Jun 17, 2026 2w ago
Description
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Threat Intelligence
EPSS Exploit Probability
66.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-349
CWE-502 Deserialization of Untrusted Data Validation
Affected Products 6
| Vendor | Product | Version | Range |
|---|---|---|---|
| infinispan | infinispan | 8.2.10 | any |
| infinispan | infinispan | 9.0.3 | any |
| infinispan | infinispan | 9.1.7 | any |
| infinispan | infinispan | 9.2.2 | any |
| infinispan | infinispan | 9.3.0 | any |
| redhat | jboss_data_grid | 7.2 | any |
References 4
- securityfocus.com http://www.securityfocus.com/bid/104218
- access.redhat.com https://access.redhat.com/errata/RHSA-2018:1833
- access.redhat.com https://access.redhat.com/errata/RHSA-2019:3892
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1576492
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.