CVE-2018-1131

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-15 · updated 2026-06-17
Weakness: CWE-349

Description

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

Affected products

Red Hat infinispan: 8.2.10, 9.0.3, 9.1.7, 9.2.2, 9.3.0-alpha1
RedHat Jboss Data Grid: 7.2

References

http://www.securityfocus.com/bid/104218
https://access.redhat.com/errata/RHSA-2018:1833
https://access.redhat.com/errata/RHSA-2019:3892
https://bugzilla.redhat.com/show_bug.cgi?id=1576492
http://www.securityfocus.com/bid/104218
https://access.redhat.com/errata/RHSA-2018:1833
https://access.redhat.com/errata/RHSA-2019:3892
https://bugzilla.redhat.com/show_bug.cgi?id=1576492

Get alerted when CVE-2018-1131 or the next vulnerability affects your stack