Improper implementation of the session fixation protection in Infinispan

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-10158 · ADVISORY
• infinispan/infinispan#6960 · WEB
• infinispan/infinispan#7025 · WEB
• infinispan/infinispan#7043 · WEB
• infinispan/infinispan commit 4b381c5 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• infinispan/infinispan · PACKAGE
• infinispan/infinispan · WEB
• security.netapp.com/advisory/ntap-20231227-0009 · WEB
• security.netapp.com/advisory/ntap-20231227-0009

Autres vulnérabilités de org.infinispan:infinispan-core

• CVE-2023-5384FAIBLE 2.7A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with…
• CVE-2020-25711MOYENNE 6.5A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operatio…
• CVE-2019-10174ÉLEVÉE 8.8A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application cl…
• CVE-2016-0750ÉLEVÉE 8.8The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious…
• CVE-2018-1131ÉLEVÉE 8.8Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with au…