VDB
RHSA-2018%3A1833
RHSA-2018%3A1833
PUBLISHED
CVSS 7.5 HIGH
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Risk Scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Data Grid |
Timeline
- Jun 12, 2018 CVE Published
- Apr 30, 2026 Distribution Patch
- Apr 30, 2026 Distribution Patch
- Apr 30, 2026 Security Advisory
- Apr 30, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2018:1833 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.grid&downloadType=distributions&version=7.2.1 advisory
- https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1576492 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1833.json advisory
- https://access.redhat.com/security/cve/CVE-2018-1131 advisory
- https://www.cve.org/CVERecord?id=CVE-2018-1131 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-1131 advisory