CVE-2018-1131
published 2018-05-15CVE-2018-1131: Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access…
PriorityP352high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
1.27%
66.6th percentile
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| infinispan | infinispan | — | — |
| infinispan | infinispan | — | — |
| infinispan | infinispan | — | — |
| infinispan | infinispan | — | — |
| infinispan | infinispan | — | — |
| red_hat_inc | infinispan | — | — |
| red_hat_inc | infinispan | — | — |
| red_hat_inc | infinispan | — | — |
| red_hat_inc | infinispan | — | — |
| red_hat_inc | infinispan | — | — |
| redhat | jboss_data_grid | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
infinispan: deserialization of data in XML and JSON transcoders
vendor_redhat·2018-05-14·CVSS 8.8
CVE-2018-1131 [HIGH] CWE-349 infinispan: deserialization of data in XML and JSON transcoders
infinispan: deserialization of data in XML and JSON transcoders
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Package: infinispan (Red Hat JBoss Data Virtualization 6) - Out of support scope
Package: infinispan (Red Hat JBoss Enterprise Application Platform 6) - Not affected
Package: infinispan-core (Red Hat JBoss Enterprise Application Platform 7) - Affected
Package: camel (Red Hat JBoss Fuse 6) - Affected
Package:
OSV
Deserialization of Untrusted Data in Infinispan
osv·2022-05-13
CVE-2018-1131 [HIGH] Deserialization of Untrusted Data in Infinispan
Deserialization of Untrusted Data in Infinispan
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
GHSA
Deserialization of Untrusted Data in Infinispan
ghsa·2022-05-13
CVE-2018-1131 [HIGH] CWE-502 Deserialization of Untrusted Data in Infinispan
Deserialization of Untrusted Data in Infinispan
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
No detection rules found.
http://www.securityfocus.com/bid/104218https://access.redhat.com/errata/RHSA-2018:1833https://access.redhat.com/errata/RHSA-2019:3892https://bugzilla.redhat.com/show_bug.cgi?id=1576492http://www.securityfocus.com/bid/104218https://access.redhat.com/errata/RHSA-2018:1833https://access.redhat.com/errata/RHSA-2019:3892https://bugzilla.redhat.com/show_bug.cgi?id=1576492
2018-05-15
Published