A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2020:0481 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2020:0727 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174 | Issue Tracking Vendor Advisory |
https://security.netapp.com/advisory/ntap-20220210-0018/ | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2020:0481 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2020:0727 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174 | Issue Tracking Vendor Advisory |
https://security.netapp.com/advisory/ntap-20220210-0018/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
|
History
21 Nov 2024, 04:18
Type | Values Removed | Values Added |
---|---|---|
References | () https://access.redhat.com/errata/RHSA-2020:0481 - Vendor Advisory | |
References | () https://access.redhat.com/errata/RHSA-2020:0727 - Vendor Advisory | |
References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174 - Issue Tracking, Vendor Advisory | |
References | () https://security.netapp.com/advisory/ntap-20220210-0018/ - Third Party Advisory |
Information
Published : 2019-11-25 11:15
Updated : 2024-11-21 04:18
NVD link : CVE-2019-10174
Mitre link : CVE-2019-10174
CVE.ORG link : CVE-2019-10174
JSON object : View
Products Affected
netapp
- active_iq_unified_manager
redhat
- single_sign-on
- jboss_data_grid
- fuse
- enterprise_linux
- openshift_application_runtimes
- jboss_enterprise_application_platform
infinispan
- infinispan
CWE
CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')