High severity · published Feb 15, 2018
CVE-2017-15089
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache
8.8
CVSS
2.8%
EPSS
No
On KEV
Description
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Infinispan · Infinispan
through 9.1.6; 9.2.0; 9.2.0; 9.2.0; 9.2.0; 9.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15089
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15089
Third Party Advisory
http://www.securitytracker.com/id/1040360
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0294
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:0478
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:0479
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:0480
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:0481
More from Infinispan
9.8
CVE-2019-10158
A flaw was found in Infinispan through version 9.4.14.Final
8.8
CVE-2019-10174
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any…
8.8
CVE-2016-0750
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events
8.8
CVE-2018-1131
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations
6.5
CVE-2023-5236
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling