A vulnerability in Infinispan was found allowing malicious users to inject malicious serialized objects into server's data cache and potentially execute arbitrary code on other user's machine when the malicious data are fetched using hotrod protocol.
A vulnerability was found in Infinispan before version 10.0.0 Final. The invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks.
A vulnerability was found in Infinispan up to version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration may result in an incorrect session handling
Referrences: https://issues.jboss.org/browse/ISPN-10224
Upstream Patch: https://github.com/infinispan/infinispan/pull/6960
A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API.
Unsafe deserialization in camel-infinispan ProtoStream remote aggregation repository. DefaultExchangeHolderUtils.deserialize() uses ClassLoadingAwareObjectInputStream.readObject() without ObjectInputFilter. Same pattern as CVE-2024-22369, CVE-2024-23114, CVE-2026-25747.
Verified on Camel 4.10.0 + Infinispan 15.1.4. Reported to security and MITRE CVE Request #2024308.
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
The REST bulk read endpoints: /rest/v2/caches/{cacheName}?action=keys /rest/v2/caches/{cacheName}?action=entries use the cluster publisher, which is an internal component which doesn't check that the subject has bulk read permissions The methods require authentication, but once authenticated, any user can invoke them successfully.
A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
A flaw was found in Infinispan, when using JGroups with JDBCPING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors.
A vulnerability has been identified in Infinispan where sensitive credentials, such as database usernames and passwords, are logged when using JGroups with JDBCPING. If a misconfiguration (such as an unresolved externaladdr) occurs, the logging mechanism records connection details, including credentials, in plaintext.
This issue can lead to credential exposure, potentially allowing unauthorized access if logs are accessible to low-privileged users or attackers.
A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.