CVE-2019-10174
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.09%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.09% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-470
- Affected
- infinispan/infinispan · redhat/fuse · redhat/jboss data grid · redhat/jboss enterprise application platform · redhat/openshift application runtimes · redhat/single sign-on · netapp/active iq unified manager
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2020:0481Vendor Advisory
- https://access.redhat.com/errata/RHSA-2020:0727Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174Issue Tracking, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220210-0018/Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0481Vendor Advisory
- https://access.redhat.com/errata/RHSA-2020:0727Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174Issue Tracking, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220210-0018/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.