What’s Vulnerable › Vulnerabilities

CVE-2017-15089

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-02-15 · updated 2026-06-17
• Weakness: CWE-502

Description

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

Affected products

• Red Hat infinispan: through 9.1.6; 9.2.0-alpha1, 9.2.0-alpha2, 9.2.0-beta1, 9.2.0-beta2, 9.2.0-cr1

References

• http://www.securitytracker.com/id/1040360
• https://access.redhat.com/errata/RHSA-2018:0294
• https://access.redhat.com/errata/RHSA-2018:0478
• https://access.redhat.com/errata/RHSA-2018:0479
• https://access.redhat.com/errata/RHSA-2018:0480
• https://access.redhat.com/errata/RHSA-2018:0481
• https://access.redhat.com/errata/RHSA-2018:0501
• https://access.redhat.com/errata/RHSA-2019:1326
• https://github.com/infinispan/infinispan/pull/5639
• http://www.securitytracker.com/id/1040360
• https://access.redhat.com/errata/RHSA-2018:0294
• https://access.redhat.com/errata/RHSA-2018:0478

Get alerted when CVE-2017-15089 or the next vulnerability affects your stack