CVE-2018-1131
Deserialization of Untrusted Data in Infinispan
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
- Record
CVE-2018-1131- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-349, CWE-502
- Updated
- 2026-11-02
CVE List No score
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
- Record
CVE-2018-1131- Weakness
- CWE-349
- Updated
- 2026-11-02
EUVDEUVD-2022-5015 No score
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
- Record
EUVD-2022-5015- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qqfc-m9hc-pqv3
Deserialization of Untrusted Data in Infinispan
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
- Record
GHSA-qqfc-m9hc-pqv3- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
- Record
CVE-2018-1131- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-qqfc-m9hc-pqv3
Deserialization of Untrusted Data in Infinispan
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
- Record
GHSA-qqfc-m9hc-pqv3- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.infinispan:infinispan-coreMaven |
8.2.10.Final to 8.2.10.Final | None known |
org.infinispan:infinispan-coreMaven |
9.0.3.Final to 9.0.3.Final | None known |
org.infinispan:infinispan-coreMaven |
9.1.7.Final to 9.1.7.Final | None known |
org.infinispan:infinispan-coreMaven |
9.2.2.Final to 9.2.2.Final | None known |
org.infinispan:infinispan-coreMaven |
9.3.0.Alpha1 to 9.3.0.Alpha1 | 9.3.1.Final |
org.infinispan:infinispan-coreMaven |
Listed versions 8.2.10.Final |
None known |
org.infinispan:infinispan-coreMaven |
Listed versions 9.0.3.Final |
None known |
org.infinispan:infinispan-coreMaven |
Listed versions 9.1.7.Final |
None known |
org.infinispan:infinispan-coreMaven |
Listed versions 9.2.2.Final |
None known |
org.infinispan:infinispan-coreMaven |
9.3.0.Alpha1 up to 9.3.1.Final, plus listed versions 9.3.0.Beta19.3.0.CR19.3.0.Final |
9.3.1.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1131 is a high vulnerability (CVSS 8.8) in Infinispan, published May 15, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in org.infinispan:infinispan-core 9.3.1.Final.