Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

12 records

Vendor: Infinispan Component: Infinispan Clear all filters
TI-2023-04814 CVE-2023-5236 · GHSA-488m-w9fp-5mm2

Infinispan: circular reference on marshalling leads to dos

Priority LOW 31

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01108 Published 2023-12-18 Partial fix · 4.6.2.Final CWE-1047
TI-2023-03388 CVE-2023-3629 · GHSA-r4w2-hjmr-36m7

Infinispan: non-admins should not be able to get cache config via rest api

Priority LOW 30

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00721 Published 2023-12-18 Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
TI-2023-03387 CVE-2023-3628 · GHSA-fhr7-8jx4-r9cp

Infispan: rest bulk ops don't check permissions

Priority LOW 30

A flaw was found in Infinispan's REST.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00797 Published 2023-12-18 Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
TI-2020-15726 CVE-2020-25711 · GHSA-8674-26jc-wh98

Missing authorization in infinispan

Priority LOW 31

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.0108 Published 2020-12-03 Fixed in 11.0.6.Final CWE-862
TI-2019-07479 CVE-2019-10158 · GHSA-6x3v-rw2q-9gx7

Session fixation in Red Hat infinispan

Priority MEDIUM 46

A flaw was found in Infinispan through version 9.4.14.Final.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01957 Published 2020-01-02 Fixed in 9.4.15.Final CWE-384
TI-2019-07495 CVE-2019-10174 · GHSA-h47x-2j37-fw5m

A vulnerability was found in Infinispan such that the invokeAccessibly method from the…

Priority MEDIUM 44

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03089 Published 2019-11-25 Partial fix · 8.2.12.Final, 9.4.17.Final CWE-470
TI-2016-00670 CVE-2016-0750 · GHSA-4hhg-8ghq-vwq6

Deserialization of untrusted data in Red Hat Infinispan

Priority MEDIUM 43

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02419 Published 2018-09-11 Partial fix · 9.1.0.Final CWE-138
TI-2017-01888 CVE-2017-2638 · GHSA-mvxp-3j62-jqr6

Missing authentication in [UNKNOWN] infinispan

Priority LOW 32

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints.

CVSS 3.0MEDIUM 6.5 Network No auth No interaction EPSS 0.01559 Published 2018-07-16 Partial fix · 9.0.0 CWE-306
TI-2018-01048 CVE-2018-1131 · GHSA-qqfc-m9hc-pqv3

Deserialization of untrusted data in Red Hat infinispan

Priority MEDIUM 40

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01186 Published 2018-05-15 Partial fix · 9.3.1.Final CWE-349
TI-2017-11063 CVE-2017-15089 · GHSA-46r5-59fg-2fjc

Deserialization of untrusted data in infinispan

Priority MEDIUM 43

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02827 Published 2018-02-15 Partial fix · 9.2.0.CR1 CWE-502