CVE-2019-10174

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-470

Affected software

Vendor	Product	Versions
[UNKNOWN]	infinispan	10.0.0.Final; 9.4.17.Final

References

https://access.redhat.com/errata/RHSA-2020:0481Vendor Advisory
https://access.redhat.com/errata/RHSA-2020:0727Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20220210-0018/Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0481Vendor Advisory
https://access.redhat.com/errata/RHSA-2020:0727Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174Issue Tracking, Vendor Advisory
https://security.netapp.com/advisory/ntap-20220210-0018/Third Party Advisory

Timeline

Published: Nov 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101756.5A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determ CVE-2019-101765.4A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component we CVE-2019-101776.5A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user in CVE-2019-101786.1It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cro CVE-2019-101796.1A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize re CVE-2019-10187.0An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thi CVE-2019-101804.8A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several paramet CVE-2019-101818.1It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising th CVE-2019-101826.5It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could t CVE-2019-101833.3Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interactio CVE-2019-101847.5undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted thro CVE-2019-101858.6It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file.