CVE-2017-15089

2018-02-1200:00:00

CWE-502

redhat

www.cve.org

8.7 High

AI Score

Confidence

High

0.035 Low

EPSS

Percentile

91.6%

JSON

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

CNA Affected

[
  {
    "product": "infinispan",
    "vendor": "Infinispan",
    "versions": [
      {
        "status": "affected",
        "version": "before 9.2.0.CR1"
      }
    ]
  }
]