What’s Vulnerable › Vulnerabilities
CVE-2019-10174
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-11-25 · updated 2026-06-17
- Weakness: CWE-470
Description
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
Affected products
- Red Hat infinispan: before 8.2.12; from 9.0.0 before 9.4.17 — fixed in 8.2.12, 9.4.17
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
- Red Hat Fuse: 1.0
- RedHat Jboss Data Grid: all versions
- Red Hat JBoss EAP: 7.2
- RedHat Openshift Application Runtimes: all versions
- Red Hat Single Sign-On: all versions
How to fix
Upgrade to a fixed version: Red Hat infinispan 8.2.12, 9.4.17. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2020:0481
- https://access.redhat.com/errata/RHSA-2020:0727
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174
- https://security.netapp.com/advisory/ntap-20220210-0018/
- https://access.redhat.com/errata/RHSA-2020:0481
- https://access.redhat.com/errata/RHSA-2020:0727
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174
- https://security.netapp.com/advisory/ntap-20220210-0018/
Get alerted when CVE-2019-10174 or the next vulnerability affects your stack