CVE-2019-10158

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158	Issue Tracking Patch Third Party Advisory
https://github.com/infinispan/infinispan/pull/6960	Third Party Advisory
https://github.com/infinispan/infinispan/pull/7025	Third Party Advisory
https://security.netapp.com/advisory/ntap-20231227-0009/

Configurations

Configuration 1 (hide)

cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*

History

27 Dec 2023, 15:15

Type	Values Removed	Values Added
References		() https://security.netapp.com/advisory/ntap-20231227-0009/ -

Information

Published : 2020-01-02 15:15

Updated : 2023-12-27 15:15

NVD link : CVE-2019-10158

Mitre link : CVE-2019-10158

CVE.ORG link : CVE-2019-10158

JSON object : View

Products Affected

redhat

jboss_data_grid

infinispan

infinispan

CWE

CWE-384

Session Fixation

{"id": "CVE-2019-10158", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-01-02T15:15:11.647", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/infinispan/infinispan/pull/6960", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/infinispan/infinispan/pull/7025", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://security.netapp.com/advisory/ntap-20231227-0009/", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-384"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en Infinispan versiones hasta la versi\u00f3n 9.4.14.Final. Una implementaci\u00f3n inapropiada de la protecci\u00f3n de fijaci\u00f3n de sesi\u00f3n en la integraci\u00f3n de Spring Session puede resultar en un manejo de sesi\u00f3n incorrecto."}], "lastModified": "2023-12-27T15:15:44.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:infinispan:infinispan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18DD24C6-07DC-4EB0-926A-475ED217F555", "versionEndIncluding": "9.4.14"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}