CVE-2019-10158: Improper implementation of session fixation protection in Infinispan
Summary
CVE-2019-10158: Improper implementation of the session fixation protection in Infinispan. Affects org.infinispan:infinispan-core versions < 9.4.15.Final. Fixed in 9.4.15.Final. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Infinispan is an open-source data grid platform that provides distributed caching and in-memory data storage capabilities. It is commonly used in Java applications to improve performance and scalability. Infinispan integrates with Spring Session, a framework that manages user sessions in web applications. This vulnerability affects versions of Infinispan up to 9.4.14.Final.
Vulnerability Detail
The vulnerability arises from an improper implementation of the session fixation protection in the Spring Session integration of Infinispan. This flaw can lead to incorrect session handling, potentially allowing an attacker to hijack user sessions or perform unauthorized actions on behalf of other users. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
9.4.15.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Infinispan to ensure proper session handling and mitigate the risk of session hijacking.
Conclusion
Infinispan versions up to 9.4.14.Final are vulnerable to an improper implementation of session fixation protection. This can lead to incorrect session handling and potential session hijacking. It is crucial to upgrade to Infinispan version 9.4.15.Final or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.infinispan:infinispan-core →
FAQ
Infinispan is an open-source data grid platform that provides distributed caching and in-memory data storage capabilities. It is commonly used in Java applications to improve performance and scalability.
Spring Session is a framework that manages user sessions in web applications. It provides features like session fixation protection to enhance the security of user sessions.
Session fixation protection is a security mechanism that prevents attackers from hijacking user sessions. It ensures that each user is assigned a unique session identifier and that the identifier is changed upon authentication.
This vulnerability can allow an attacker to hijack user sessions or perform unauthorized actions on behalf of other users. This can lead to unauthorized access to sensitive information, manipulation of user data, and other security breaches.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.infinispan:infinispan-core.
