VDB
CVE-2018-1131
CVE-2018-1131
PUBLISHED
CVSS 6.5 MEDIUM
Reported by redhat · Published May 15, 2018
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Risk Scores
CVSS 2.0
6.5
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat, Inc. | infinispan | 9.0.3.Final, 9.1.7.Final, 8.2.10.Final |
| Maven | org.infinispan:infinispan-core | 8.2.10.Final], 8.2.10.Final] |
| Red Hat, Inc. | infinispan | 9.1.7.Final, 8.2.10.Final, 9.3.0.Alpha1 |
Timeline
- May 15, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 27, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 3, 2022 EPSS Score
- May 5, 2022 EPSS Score
- Jun 29, 2022 CVE Updated
- Jul 7, 2022 EPSS Score
- Sep 9, 2022 EPSS Score
- Nov 11, 2022 EPSS Score
References
- x_refsource_CONFIRM
- 104218 vdb-entryx_refsource_BID
- RHSA-2018:1833 vendor-advisoryx_refsource_REDHAT
- RHSA-2019:3892 vendor-advisoryx_refsource_REDHAT
- https://nvd.nist.gov/vuln/detail/CVE-2018-1131 advisory
- https://github.com/advisories/GHSA-qqfc-m9hc-pqv3 advisory