-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.infinispan:infinispan-core | maven | <= 8.2.11.Final | 8.2.12.Final |
| org.infinispan:infinispan-core | maven | >= 9.0.0.Final, <= 9.4.16.Final | 9.4.17.Final |
Miggo AIRoot Cause AnalysisThe vulnerability stems directly from the public exposure of ReflectionUtil.invokeAccessibly, as confirmed by the patch which made it non-public (renamed to invokeMethod). The commit message explicitly states 'ReflectionUtil.invokeAccessibly should not be public' as the fix. The method's implementation delegated to SecurityActions.invokeAccessibly which bypassed Java security manager checks, allowing untrusted code to leverage Infinispan's privileges for unsafe reflection.
Ongoing coverage of React2Shell