| Package | Affected versions | Patched versions |
|---|---|---|
| org.infinispan:infinispan-core | < 9.2.0.CR1 | 9.2.0.CR1 |
| infinispan | = 9.2.0≤ 9.1.6 |
It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free