Infinispan
Infinispan: vulnerabilidades y CVE
Infinispan tiene 16 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE16
Últimos 12 meses2
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-15555 | Alta (8.8) | 0.32% | — | 11 ago 2026 | A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization… |
| CVE-2026-6857 | Alta (7.5) | 1.2% | — | 22 abr 2026 | A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially… |
| CVE-2025-5731 | Media (5.5) | 0.17% | — | 26 jun 2025 | A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a… |
| CVE-2024-6875 | Media (6.5) | 0.49% | — | 28 mar 2025 | A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the… |
| CVE-2025-0736 | Media (5.5) | 0.21% | — | 28 ene 2025 | A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging… |
| CVE-2023-5384 | Baja (2.7) | 0.54% | — | 18 dic 2023 | A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text… |
| CVE-2023-5236 | Media (6.5) | 1.1% | — | 18 dic 2023 | A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and… |
| CVE-2023-3629 | Media (6.5) | 0.72% | — | 18 dic 2023 | A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of… |
| CVE-2023-3628 | Media (6.5) | 0.80% | — | 18 dic 2023 | A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended… |
| CVE-2020-25711 | Media (6.5) | 1.1% | — | 3 dic 2020 | A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations… |
| CVE-2019-10158 | Crítica (9.8) | 2.0% | — | 2 ene 2020 | A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling. |
| CVE-2019-10174 | Alta (8.8) | 3.1% | — | 25 nov 2019 | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The… |
| CVE-2016-0750 | Alta (8.8) | 2.4% | — | 11 sept 2018 | The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized… |
| CVE-2017-2638 | Media (6.5) | 1.6% | — | 16 jul 2018 | It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name. |
| CVE-2018-1131 | Alta (8.8) | 1.2% | — | 15 may 2018 | Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache… |
| CVE-2017-15089 | Alta (8.8) | 2.8% | — | 15 feb 2018 | It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.