CVE-2019-10174CWE-470
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke…
High · published November 25, 2019
What it is
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
The record
Technical detail
- CVSS v3.0
- 7.5 · HIGH
- Vector
- CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.03089 · 87.5th percentile
- Weakness
- CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
- Published
- 2019-11-25T10:26Z
EPSS history
Timeline