Infinispan
By the Year
In 2024 there have been 0 vulnerabilities in Infinispan . Last year Infinispan had 4 security vulnerabilities published. Right now, Infinispan is on track to have less security vulnerabilities in 2024 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 0 | 0.00 |
| 2023 | 4 | 5.55 |
| 2022 | 0 | 0.00 |
| 2021 | 2 | 8.45 |
| 2020 | 3 | 7.47 |
| 2019 | 1 | 8.80 |
| 2018 | 1 | 8.80 |
It may take a day or so for new Infinispan vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Infinispan Security Vulnerabilities
A flaw was found in Infinispan
CVE-2023-5384
2.7 - Low
- December 18, 2023
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
Cleartext Storage of Sensitive Information
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling
CVE-2023-5236
6.5 - Medium
- December 18, 2023
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation
CVE-2023-3629
6.5 - Medium
- December 18, 2023
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
A flaw was found in Infinispan's REST
CVE-2023-3628
6.5 - Medium
- December 18, 2023
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0)
CVE-2021-31917
9.8 - Critical
- September 21, 2021
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
authentification
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests
CVE-2020-10771
7.1 - High
- June 02, 2021
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.
Session Riding
A flaw was found in infinispan 10 REST API
CVE-2020-25711
6.5 - Medium
- December 03, 2020
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
AuthZ
A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls
CVE-2020-10746
6.1 - Medium
- October 19, 2020
A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.
A flaw was found in Infinispan through version 9.4.14.Final
CVE-2019-10158
9.8 - Critical
- January 02, 2020
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
Session Fixation
A vulnerability was found in Infinispan such
CVE-2019-10174
8.8 - High
- November 25, 2019
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
Reflection Injection
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations
CVE-2018-1131
8.8 - High
- May 15, 2018
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Marshaling, Unmarshaling
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Jboss Data Grid or by Infinispan? Click the Watch button to subscribe.
