Description
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Remediation
References
http://www.securityfocus.com/bid/104218
https://access.redhat.com/errata/RHSA-2018:1833
https://access.redhat.com/errata/RHSA-2019:3892
https://bugzilla.redhat.com/show_bug.cgi?id=1576492
Related Vulnerabilities
CVE-2019-10380 Vulnerability in maven package org.jenkins-ci.plugins:simple-travis-runner
CVE-2023-33546 Vulnerability in maven package org.codehaus.janino:janino-parent
CVE-2023-41034 Vulnerability in maven package org.eclipse.leshan:leshan-core
CVE-2019-10241 Vulnerability in maven package org.eclipse.jetty.aggregate:jetty-all
CVE-2022-37724 Vulnerability in maven package wonder.utilities:utilities