CVE-2019-10174 Use of Externally-Controlled Input to Select Classes or Code in Infinispan
HighCVSS 8.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.infinispan/infinispan-core(Maven) | <= 8.2.11.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | >= 9.0.0.Final, <= 9.4.16.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | < 8.2.12.Final | 8.2.12.Final |
| org.infinispan/infinispan-core(Maven) | = 5.0.0.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.0.1.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.ALPHA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.ALPHA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.BETA5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.CR4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.0.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.1.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.1.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.2.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.2.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.3.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.3.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.4.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.4.FINAL | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.infinispan/infinispan-core(Maven) | = 5.1.5.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.5.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.6.FINAL | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.1.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.ALPHA1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.ALPHA2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Beta6 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.10.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.11.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.11.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.12.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.13.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.14.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.15.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.18.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.19.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.20.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.7-wolfc-1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.8.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.2.9.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 5.3.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 6.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha4 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Alpha5 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.0.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.1.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 7.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Beta3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.1.9.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.10.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.11.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 8.2.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | >= 9.0.0.Final, < 9.4.17.Final | 9.4.17.Final |
| org.infinispan/infinispan-core(Maven) | = 9.0.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.0.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.1.7.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Alpha2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Beta2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.2.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.2.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.3.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.4.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.5.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.6.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.8.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.3.9.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.0.Alpha1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.0.Beta1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.0.CR1 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.0.CR2 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.0.CR3 | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.0.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.1.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.10.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.11.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.12.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.13.Final | No fix listed |
| org.infinispan/infinispan-core(Maven) | = 9.4.14.Final | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2020:0481 vendor-advisory
- RHSA-2020:0727 vendor-advisory
- bugzilla.redhat.com issue-tracking vendor-advisory
- security.netapp.com third-party-advisory
- github.com patch
- github.com patch
- github.com
- github.com product