VYPR
← All advisories
High severity8.8NVD Advisory· Published May 15, 2018· Updated Jun 17, 2026

CVE-2018-1131

CVE-2018-1131

Description

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.infinispan:infinispan-coreMaven
>= 9.3.0.Alpha1, < 9.3.1.Final9.3.1.Final

Affected products

8
  • Red Hat, Inc./infinispanv5
    Range: 9.0.3.Final
  • ghsa-coords
    pkg:maven/org.infinispan/infinispan-core
  • Infinite/Infinispan5 versions
    cpe:2.3:a:infinispan:infinispan:8.2.10:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:infinispan:infinispan:8.2.10:*:*:*:*:*:*:*
    • cpe:2.3:a:infinispan:infinispan:9.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:infinispan:infinispan:9.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:infinispan:infinispan:9.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:infinispan:infinispan:9.3.0:alpha1:*:*:*:*:*:*
  • Red Hat/DataGrid
    cpe:2.3:a:redhat:jboss_data_grid:7.2:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.