CVE-2019-10174CWE-470

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke…

High · published November 25, 2019

CVSS v3.0
7.5
EPSS
3%
Percentile
87.5
In the wild
Unconfirmed
What it is

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03089 · 87.5th percentile
Weakness
CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Published
2019-11-25T10:26Z
EPSS history
Timeline
  • 25 NOV 10:26Z
    A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke…
    cvelistv5