CVE-2019-10174
Summary
| CVE | CVE-2019-10174 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-11-25 11:15:00 UTC |
| Updated | 2022-02-20 06:31:00 UTC |
| Description | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application. |
Risk And Classification
Problem Types: CWE-470
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Infinispan | Infinispan | All | All | All | All |
| Application | Infinispan | Infinispan | All | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Application | Netapp | Active Iq Unified Manager | - | All | All | All |
| Operating System | Redhat | Enterprise Linux | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Application | Redhat | Fuse | 1.0 | All | All | All |
| Application | Redhat | Jboss Data Grid | - | All | All | All |
| Application | Redhat | Jboss Enterprise Application Platform | - | All | All | All |
| Application | Redhat | Jboss Enterprise Application Platform | 7.2 | All | All | All |
| Application | Redhat | Openshift Application Runtimes | - | All | All | All |
| Application | Redhat | Single Sign-on | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| 1703469 – (CVE-2019-10174) CVE-2019-10174 infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods | CONFIRM | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| Red Hat Customer Portal | REDHAT | access.redhat.com | |
| CVE-2019-10174 Infinispan Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.