Infinispan Infinispan

Do you want an email whenever new security vulnerabilities are reported in Infinispan?

By the Year

In 2022 there have been 0 vulnerabilities in Infinispan . Last year Infinispan had 2 security vulnerabilities published. Right now, Infinispan is on track to have less security vulnerabilities in 2022 than it did last year.

Year Vulnerabilities Average Score
2022 0 0.00
2021 2 8.45
2020 3 7.47
2019 1 8.80
2018 1 8.80

It may take a day or so for new Infinispan vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Infinispan Security Vulnerabilities

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0)

CVE-2021-31917 9.8 - Critical - September 21, 2021

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

authentification

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests

CVE-2020-10771 7.1 - High - June 02, 2021

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.

Session Riding

A flaw was found in infinispan 10 REST API

CVE-2020-25711 6.5 - Medium - December 03, 2020

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

AuthZ

A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls

CVE-2020-10746 6.1 - Medium - October 19, 2020

A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.

A flaw was found in Infinispan through version 9.4.14.Final

CVE-2019-10158 9.8 - Critical - January 02, 2020

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

Session Fixation

A vulnerability was found in Infinispan such

CVE-2019-10174 8.8 - High - November 25, 2019

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

Reflection Injection

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations

CVE-2018-1131 8.8 - High - May 15, 2018

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

Marshaling, Unmarshaling

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Red Hat Jboss Data Grid or by Infinispan? Click the Watch button to subscribe.

Infinispan
Vendor

Infinispan
Product

subscribe