Read the docs
TI-2019-07495 Aliases CVE-2019-10174GHSA-h47x-2j37-fw5m

A vulnerability was found in Infinispan such that the invokeAccessibly method from the…

Priority MEDIUM 44CWE-470Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 11 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

Why it matters now

EPSS 0.03089 87th percentileScored 2026-11-07
Fix Partial org.infinispan:infinispan-core (Maven): 8.2.12.Final, 9.4.17.FinalRed Hat: 9 advisoriesRed Hat: 11 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]infinispan10.0.0.Final; 9.4.17.Final—No fix listedCNA
—org.infinispan:infinispan-core (Maven)before 8.2.12.Final8.2.12.FinalPatch availableGHSA-h47x-2j37-fw5m
—org.infinispan:infinispan-core (Maven)9.0.0.Final to before 9.4.17.Final9.4.17.FinalPatch availableGHSA-h47x-2j37-fw5m
  • infinispan Vendor[UNKNOWN] Affected 10.0.0.Final; 9.4.17.Final Fixed in — No fix listed CNA
  • org.infinispan:infinispan-core (Maven) Vendor— Affected before 8.2.12.Final Fixed in 8.2.12.Final Patch available GHSA-h47x-2j37-fw5m
  • org.infinispan:infinispan-core (Maven) Vendor— Affected 9.0.0.Final to before 9.4.17.Final Fixed in 9.4.17.Final Patch available GHSA-h47x-2j37-fw5m

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*before 8.2.12; 9.0.0 to before 9.4.17VulnerableInfinispan
cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
  • cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:* Versions before 8.2.12; 9.0.0 to before 9.4.17 Vulnerable ·Infinispan
  • cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-h47x-2j37-fw5m org.infinispan:infinispan-core (Maven) Fixed in 8.2.12.Final Advisory →
  • Fix · GHSA-h47x-2j37-fw5m org.infinispan:infinispan-core (Maven) Fixed in 9.4.17.Final Advisory →

Red Hat 9 advisories

  • RHSA-2024:5856 Released 2024-08-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
  • RHSA-2020:2333 Released 2020-05-28 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 19 security update
    • EAP-CD 19 Tech Preview
  • RHSA-2020:2113 Released 2020-05-12 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.8 security update
    • Red Hat Single Sign On 7.3
Show 6 more Red Hat advisories
  • RHSA-2020:2063 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el6eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el6eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el6eap +7
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el7eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el7eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el7eap +7
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el8eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el8eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el8eap +7
  • RHSA-2020:2062 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2020:0983 Released 2020-03-26 · Red Hat rating Important
    Red Hat Fuse 7.6.0 security update
    • Red Hat Fuse 7.6.0
  • RHSA-2020:0727 Released 2020-03-05 · Red Hat rating Important
    Red Hat Data Grid 7.3.3 security update
    • Red Hat Data Grid 7.3.3
  • RHSA-2020:0481 Released 2020-02-12 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R15 security and bug fix update
    • Red Hat Fuse 6.3
  • RHSA-2019:3901 Released 2019-11-18 · Red Hat rating Important
    Red Hat OpenShift Application Runtimes Vert.x 3.8.3 security update
    • Red Hat Openshift Application Runtimes Vert.x 3.8.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix planned: Will not fix
EAP-CD 19 Tech PreviewFixed RHSA-2020:2333
Red Hat Data Grid 7.3.3Fixed RHSA-2020:0727
Red Hat Fuse 6.3Fixed RHSA-2020:0481
Red Hat Fuse 7.6.0Fixed RHSA-2020:0983
Red Hat JBoss EAP 7.2Fixed RHSA-2020:2062
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:2063
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:2063
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:2063
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:5856
Red Hat Openshift Application Runtimes Vert.x 3.8.3Fixed RHSA-2019:3901
Red Hat Single Sign On 7.3Fixed RHSA-2020:2113
Not affected: 4 products
  • Red Hat Decision Manager 7
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10174
  2. 2026-10-03 Alias added: GHSA-h47x-2j37-fw5m

References

Advisory 5

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences