{"id":"CVE-2019-10158","aliases":["EUVD-2020-0250","GHSA-6x3v-rw2q-9gx7"],"status":"published","title":"Improper implementation of the session fixation protection in Infinispan","description":"A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.01957,"percentile":0.80401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-384"],"published":"2020-01-02T14:28:44Z","modified":"2026-10-24T10:50:33Z","fixes":[{"ecosystem":"Maven","package":"org.infinispan:infinispan-core","fixed_in":["9.4.15.Final"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.infinispan:infinispan-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15.Final"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.infinispan:infinispan-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.15.Final"}]}],"versions":["5.0.0.FINAL","5.0.1.FINAL","5.1.0.ALPHA1","5.1.0.ALPHA2","5.1.0.BETA1","5.1.0.BETA2","5.1.0.BETA3","5.1.0.BETA4","5.1.0.BETA5","5.1.0.CR1","5.1.0.CR2","5.1.0.CR3","5.1.0.CR4","5.1.0.FINAL","5.1.1.CR1","5.1.1.FINAL","5.1.2.CR1","5.1.2.FINAL","5.1.3.CR1","5.1.3.FINAL","5.1.4.CR1","5.1.4.FINAL","5.1.5.CR1","5.1.5.FINAL","5.1.6.FINAL","5.1.7.Final","5.1.8.Final","5.2.0.ALPHA1","5.2.0.ALPHA2","5.2.0.Alpha3","5.2.0.Alpha4","5.2.0.Beta1","5.2.0.Beta2","5.2.0.Beta3","5.2.0.Beta4","5.2.0.Beta5","5.2.0.Beta6","5.2.0.CR1","5.2.0.CR2","5.2.0.CR3","5.2.0.Final","5.2.1.Final","5.2.10.Final","5.2.11.CR1","5.2.11.Final","5.2.12.Final","5.2.13.Final","5.2.14.Final","5.2.15.Final","5.2.18.Final","5.2.19.Final","5.2.2.Final","5.2.20.Final","5.2.3.Final","5.2.4.Final","5.2.5.Final","5.2.6.Final","5.2.7-wolfc-1","5.2.7.Final","5.2.8.CR1","5.2.8.Final","5.2.9.Final","5.3.0.Alpha1","5.3.0.Beta1","5.3.0.Beta2","5.3.0.CR1","5.3.0.CR2","5.3.0.Final","6.0.0.Alpha1","6.0.0.Alpha2","6.0.0.Alpha3","6.0.0.Alpha4","6.0.0.Beta1","6.0.0.Beta2","6.0.0.CR1","6.0.0.Final","6.0.1.Final","6.0.2.Final","7.0.0.Alpha1","7.0.0.Alpha2","7.0.0.Alpha3","7.0.0.Alpha4","7.0.0.Alpha5","7.0.0.Beta1","7.0.0.Beta2","7.0.0.CR1","7.0.0.CR2","7.0.0.Final","7.0.1.Final","7.0.2.Final","7.0.3.Final","7.1.0.Alpha1","7.1.0.Beta1","7.1.0.CR1","7.1.0.CR2","7.1.0.Final","7.1.1.Final","7.2.0.Alpha1","7.2.0.Beta1","7.2.0.Beta2","7.2.0.CR1","7.2.0.Final","7.2.1.Final","7.2.2.Final","7.2.3.Final","7.2.4.Final","7.2.5.Final","8.0.0.Alpha1","8.0.0.Alpha2","8.0.0.Beta1","8.0.0.Beta2","8.0.0.Beta3","8.0.0.CR1","8.0.0.Final","8.0.1.Final","8.0.2.Final","8.1.0.Alpha1","8.1.0.Alpha2","8.1.0.Beta1","8.1.0.CR1","8.1.0.Final","8.1.1.Final","8.1.2.Final","8.1.3.Final","8.1.4.Final","8.1.5.Final","8.1.6.Final","8.1.7.Final","8.1.8.Final","8.1.9.Final","8.2.0.Beta1","8.2.0.Beta2","8.2.0.CR1","8.2.0.Final","8.2.1.Final","8.2.10.Final","8.2.11.Final","8.2.12.Final","8.2.2.Final","8.2.3.Final","8.2.4.Final","8.2.5.Final","8.2.6.Final","8.2.7.Final","8.2.8.Final","9.0.0.Alpha1","9.0.0.Alpha2","9.0.0.Alpha3","9.0.0.Alpha4","9.0.0.Beta1","9.0.0.Beta2","9.0.0.CR1","9.0.0.CR2","9.0.0.CR3","9.0.0.CR4","9.0.0.Final","9.0.1.Final","9.0.2.Final","9.0.3.Final","9.1.0.Alpha1","9.1.0.Beta1","9.1.0.CR1","9.1.0.Final","9.1.1.Final","9.1.2.Final","9.1.3.Final","9.1.4.Final","9.1.5.Final","9.1.6.Final","9.1.7.Final","9.2.0.Alpha1","9.2.0.Alpha2","9.2.0.Beta1","9.2.0.Beta2","9.2.0.CR1","9.2.0.CR2","9.2.0.CR3","9.2.0.Final","9.2.1.Final","9.2.2.Final","9.2.3.Final","9.2.4.Final","9.2.5.Final","9.3.0.Alpha1","9.3.0.Beta1","9.3.0.CR1","9.3.0.Final","9.3.1.Final","9.3.2.Final","9.3.3.Final","9.3.4.Final","9.3.5.Final","9.3.6.Final","9.3.8.Final","9.3.9.Final","9.4.0.Alpha1","9.4.0.Beta1","9.4.0.CR1","9.4.0.CR2","9.4.0.CR3","9.4.0.Final","9.4.1.Final","9.4.10.Final","9.4.11.Final","9.4.12.Final","9.4.13.Final","9.4.14.Final","9.4.2.Final","9.4.3.Final","9.4.4.Final","9.4.5.Final","9.4.6.Final","9.4.7.Final","9.4.8.Final","9.4.9.Final"]}],"products":[{"vendor":"infinispan","product":"infinispan"},{"vendor":"red hat","product":"infinispan"},{"vendor":"redhat","product":"jboss_data_grid"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10158","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/infinispan/infinispan/pull/6960","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/infinispan/infinispan/pull/7025","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231227-0009/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10158","tags":["advisory"]},{"url":"https://github.com/infinispan/infinispan/commit/4b381c5910265972ccaabefbdbd16a2b929f6b72","tags":["web"]},{"url":"https://github.com/infinispan/infinispan/pull/7043","tags":["web"]},{"url":"https://github.com/infinispan/infinispan/commits/9.4.15.Final/"},{"url":"https://github.com/advisories/GHSA-6x3v-rw2q-9gx7"},{"url":"https://github.com/infinispan/infinispan","tags":["package"]},{"url":"https://github.com/infinispan/infinispan/commits/9.4.15.Final","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20231227-0009","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-10158","description":"A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.","status":"published","published":"2020-01-02T14:28:44Z","modified":"2025-02-13T16:27:20.229Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2020-0250","description":"A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.","status":"published","published":"2020-01-02T14:28:44Z","modified":"2025-02-13T16:27:20Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-6x3v-rw2q-9gx7","title":"Improper implementation of the session fixation protection in Infinispan","description":"A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.","status":"published","published":"2020-01-21T21:18:44Z","modified":"2024-01-05T05:05:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:37:29.411214Z"}],"nvd":[{"id":"CVE-2019-10158","description":"A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.","status":"published","published":"2020-01-02T15:15:11.647Z","modified":"2026-06-17T02:10:22.757Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:05:41.313583Z"}],"osv":[{"id":"CVE-2019-10158","description":"A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.","status":"published","published":"2020-01-02T15:15:11.647Z","modified":"2026-10-24T10:50:33.812589867Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-6x3v-rw2q-9gx7","title":"Improper implementation of the session fixation protection in Infinispan","description":"A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.","status":"published","published":"2020-01-21T21:18:44Z","modified":"2024-02-20T05:32:45.335053Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}