# CVE-2017-15089: Deserialization of Untrusted Data in Infinispan

Source: https://junglewise.ai/threats/cve-2017-15089-deserialization-of-untrusted-data-in-infinispan  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-14  
License: CC BY 4.0 with a link back

CVE-2017-15089 · Severity: low · CVSS 3 · Published 2022-05-14

Deserialization of Untrusted Data in Infinispan

Technologies: [org.infinispan:infinispan-core (Maven)](https://junglewise.ai/threats/technologies/org-infinispan-infinispan-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2017-15089 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-15089 being exploited in the wild.

**How severe is CVE-2017-15089?** Low severity, with a CVSS score of 3, published 14 May 2022.

**Which products and versions are affected?** org.infinispan:infinispan-core (Maven) ECOSYSTEM:introduced=0,fixed=9.2.0.CR1.

**Is there a fix for CVE-2017-15089?** Yes. org.infinispan:infinispan-core (Maven): upgrade to 9.2.0.CR1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2017-15089?** Check whether you run org.infinispan:infinispan-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.infinispan:infinispan-core (Maven): upgrade to 9.2.0.CR1 or later

  ```sh
  # set org.infinispan:infinispan-core to 9.2.0.CR1 in your pom.xml or build.gradle
  ```


## Affected products

- org.infinispan:infinispan-core (Maven) ECOSYSTEM:introduced=0,fixed=9.2.0.CR1

## Identifiers

- CVE-2017-15089
- GHSA-46r5-59fg-2fjc

## Related threats

- [Infinispan caches credentials in clear text](https://junglewise.ai/threats/cve-2023-5384-infinispan-caches-credentials-in-clear-text)
- [Use of Externally-Controlled Input to Select Classes or Code in Infinispan](https://junglewise.ai/threats/cve-2019-10174-use-of-externally-controlled-input-to-select-classes-or-code-in)
- [Infinispan Hot Rod Java client insecure deserialization](https://junglewise.ai/threats/cve-2016-0750-infinispan-hot-rod-java-client-insecure-deserialization)
- [Deserialization of Untrusted Data in Infinispan](https://junglewise.ai/threats/cve-2018-1131-deserialization-of-untrusted-data-in-infinispan)
- [Improper Access Control in infinispan-server-runtime](https://junglewise.ai/threats/cve-2020-25711-improper-access-control-in-infinispan-server-runtime)