Read the docs

Infinispan

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

Infinispan records in CISA KEV

No Infinispan vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Infinispan 12 records MEDIUM Infinispan-server-rest 2 records MEDIUM Hot Rod 1 record LOW Infinispan-server-runtime 1 record LOW

Records

16 records

TI-2019-07479 CVE-2019-10158 · GHSA-6x3v-rw2q-9gx7

Session fixation in Red Hat infinispan

Priority MEDIUM 46

A flaw was found in Infinispan through version 9.4.14.Final.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01957 Published 2020-01-02 Fixed in 9.4.15.Final CWE-384
TI-2021-11905 CVE-2021-31917 · GHSA-gwqg-r7f7-jjw4

Improper authentication in Red Hat DataGrid and Infinispan

Priority MEDIUM 45

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01347 Published 2021-09-21 Fixed CWE-287
TI-2019-07495 CVE-2019-10174 · GHSA-h47x-2j37-fw5m

A vulnerability was found in Infinispan such that the invokeAccessibly method from the…

Priority MEDIUM 44

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03089 Published 2019-11-25 Partial fix · 8.2.12.Final, 9.4.17.Final CWE-470
TI-2017-11063 CVE-2017-15089 · GHSA-46r5-59fg-2fjc

Deserialization of untrusted data in infinispan

Priority MEDIUM 43

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02827 Published 2018-02-15 Partial fix · 9.2.0.CR1 CWE-502
TI-2016-00670 CVE-2016-0750 · GHSA-4hhg-8ghq-vwq6

Deserialization of untrusted data in Red Hat Infinispan

Priority MEDIUM 43

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02419 Published 2018-09-11 Partial fix · 9.1.0.Final CWE-138
TI-2018-01048 CVE-2018-1131 · GHSA-qqfc-m9hc-pqv3

Deserialization of untrusted data in Red Hat infinispan

Priority MEDIUM 40

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01186 Published 2018-05-15 Partial fix · 9.3.1.Final CWE-349
TI-2020-08666 CVE-2020-10771 · GHSA-84m7-cxq5-q9xc

Cross-site request forgery in Infinispan

Priority LOW 32

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00445 Published 2021-06-02 Fixed CWE-352
TI-2017-01888 CVE-2017-2638 · GHSA-mvxp-3j62-jqr6

Missing authentication in [UNKNOWN] infinispan

Priority LOW 32

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints.

CVSS 3.0MEDIUM 6.5 Network No auth No interaction EPSS 0.01559 Published 2018-07-16 Partial fix · 9.0.0 CWE-306
TI-2023-04814 CVE-2023-5236 · GHSA-488m-w9fp-5mm2

Infinispan: circular reference on marshalling leads to dos

Priority LOW 31

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01108 Published 2023-12-18 Partial fix · 4.6.2.Final CWE-1047
TI-2020-15726 CVE-2020-25711 · GHSA-8674-26jc-wh98

Missing authorization in infinispan

Priority LOW 31

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.0108 Published 2020-12-03 Fixed in 11.0.6.Final CWE-862
TI-2023-03388 CVE-2023-3629 · GHSA-r4w2-hjmr-36m7

Infinispan: non-admins should not be able to get cache config via rest api

Priority LOW 30

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00721 Published 2023-12-18 Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
TI-2023-03387 CVE-2023-3628 · GHSA-fhr7-8jx4-r9cp

Infispan: rest bulk ops don't check permissions

Priority LOW 30

A flaw was found in Infinispan's REST.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00797 Published 2023-12-18 Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
TI-2020-08644 CVE-2020-10746 · GHSA-3g48-cr7g-6ph4

Missing authorization in Infinispan

Priority LOW 27

A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs.

CVSS 3.1MEDIUM 6.1 Local Low privileges No interaction EPSS 0.00236 Published 2020-10-19 Partial fix CWE-862
Open these records in search →