Description

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158

https://github.com/infinispan/infinispan/pull/6960

https://github.com/infinispan/infinispan/pull/7025

https://security.netapp.com/advisory/ntap-20231227-0009/

Related Vulnerabilities

CVE-2023-46998 Vulnerability in maven package org.webjars.npm:bootbox

CVE-2021-21343 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2023-49280 Vulnerability in maven package org.xwiki.contrib.changerequest:application-changerequest-default

CVE-2022-39299 Vulnerability in npm package @node-saml/passport-saml

CVE-2021-43821 Vulnerability in maven package org.opencastproject:opencast-ingest-service-impl

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Patch Third Party Advisory CWE-384