Description
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Remediation
References
http://www.securityfocus.com/bid/104218
https://access.redhat.com/errata/RHSA-2018:1833
https://access.redhat.com/errata/RHSA-2019:3892
https://bugzilla.redhat.com/show_bug.cgi?id=1576492
Related Vulnerabilities
CVE-2016-0760 Vulnerability in maven package org.apache.sentry:sentry-binding-hive
CVE-2017-7676 Vulnerability in maven package org.apache.ranger:ranger
CVE-2021-21304 Vulnerability in npm package dynamoose
CVE-2012-0393 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa-snowflake