5 results (0.015 seconds)

CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0

CVE-2020-25711 – infinispan: authorization check missing for server management operations

https://notcve.org/view.php?id=CVE-2020-25711

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role. Se encontró un fallo en la API REST de infinispan versión 10, donde los permisos de autorización no son comprobados mientras se llevan a cabo algunas operaciones de administración del servidor. Cuando authz está habilitada, cualquier usuario con autenticación puede realizar operaciones como apagar el servidor sin el rol de ADMIN A flaw was found in the Infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role. • https://bugzilla.redhat.com/show_bug.cgi?id=1897618 https://security.netapp.com/advisory/ntap-20220210-0023 https://access.redhat.com/security/cve/CVE-2020-25711 • CWE-862: Missing Authorization •

CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0

CVE-2019-10158 – infinispan: Session fixation protection broken for Spring Session integration

https://notcve.org/view.php?id=CVE-2019-10158

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling. Se encontró un fallo en Infinispan versiones hasta la versión 9.4.14.Final. Una implementación inapropiada de la protección de fijación de sesión en la integración de Spring Session puede resultar en un manejo de sesión incorrecto. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158 https://github.com/infinispan/infinispan/pull/6960 https://github.com/infinispan/infinispan/pull/7025 https://security.netapp.com/advisory/ntap-20231227-0009 https://access.redhat.com/security/cve/CVE-2019-10158 https://bugzilla.redhat.com/show_bug.cgi?id=1714359 • CWE-384: Session Fixation •

CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 0

CVE-2019-10174 – infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods

https://notcve.org/view.php?id=CVE-2019-10174

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application. Se encontró una vulnerabilidad en Infinispan, de modo que el método invokeAccessibly de la clase pública ReflectionUtil permite que cualquier clase de aplicación invoque métodos privados en cualquier clase con los privilegios de Infinispan. El atacante puede usar la reflexión para introducir un nuevo comportamiento malicioso en la aplicación. • https://access.redhat.com/errata/RHSA-2020:0481 https://access.redhat.com/errata/RHSA-2020:0727 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174 https://security.netapp.com/advisory/ntap-20220210-0018 https://access.redhat.com/security/cve/CVE-2019-10174 https://bugzilla.redhat.com/show_bug.cgi?id=1703469 • CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') •

CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2018-1131 – infinispan: deserialization of data in XML and JSON transcoders

https://notcve.org/view.php?id=CVE-2018-1131

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected. Infinispan permite la deserialización incorrecta de datos fiables mediante transcodificadores XML y JSON en ciertas configuraciones del servidor. Un usuario con acceso autenticado al servidor podría enviar un objeto malicioso a una caché configurada para aceptar ciertos tipos de objetos, logrando la ejecución de código y, posiblemente, más ataques. • http://www.securityfocus.com/bid/104218 https://access.redhat.com/errata/RHSA-2018:1833 https://access.redhat.com/errata/RHSA-2019:3892 https://bugzilla.redhat.com/show_bug.cgi?id=1576492 https://access.redhat.com/security/cve/CVE-2018-1131 • CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data CWE-502: Deserialization of Untrusted Data •

CVSS: 8.8EPSS: 3%CPEs: 6EXPL: 0

CVE-2017-15089 – infinispan: Unsafe deserialization of malicious object injected into data cache

https://notcve.org/view.php?id=CVE-2017-15089

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks. Se ha descubierto que el cliente Hotrod en Infinispan, en versiones anteriores a la 9.2.0.CR1 lee de forma insegura los datos deserializados en la información de la caché. Un atacante autenticado podría inyectar un objeto malicioso en la caché de datos y lograr la deserialización en el cliente, además de llevar a cabo ataques a mayores. It was found that the Hotrod client in Infinispan would unsafely read deserialized data on information from the cache. • http://www.securitytracker.com/id/1040360 https://access.redhat.com/errata/RHSA-2018:0294 https://access.redhat.com/errata/RHSA-2018:0478 https://access.redhat.com/errata/RHSA-2018:0479 https://access.redhat.com/errata/RHSA-2018:0480 https://access.redhat.com/errata/RHSA-2018:0481 https://access.redhat.com/errata/RHSA-2018:0501 https://access.redhat.com/errata/RHSA-2019:1326 https://github.com/infinispan/infinispan/pull/5639 https://access.redhat.com/security/cve/CVE-2 • CWE-502: Deserialization of Untrusted Data •