# CVE-2019-10158: Improper implementation of the session fixation protection in Infinispan

Source: https://junglewise.ai/threats/cve-2019-10158-improper-implementation-of-the-session-fixation-protection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-01-21  
License: CC BY 4.0 with a link back

CVE-2019-10158 · Severity: low · CVSS 3.1 · Published 2020-01-21

Improper implementation of the session fixation protection in Infinispan

Technologies: [org.infinispan:infinispan-core (Maven)](https://junglewise.ai/threats/technologies/org-infinispan-infinispan-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2019-10158 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-10158 being exploited in the wild.

**How severe is CVE-2019-10158?** Low severity, with a CVSS score of 3.1, published 21 January 2020.

**Which products and versions are affected?** org.infinispan:infinispan-core (Maven) ECOSYSTEM:introduced=0,fixed=9.4.15.Final.

**Is there a fix for CVE-2019-10158?** Yes. org.infinispan:infinispan-core (Maven): upgrade to 9.4.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2019-10158?** Check whether you run org.infinispan:infinispan-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.infinispan:infinispan-core (Maven): upgrade to 9.4.15.Final or later

  ```sh
  # set org.infinispan:infinispan-core to 9.4.15.Final in your pom.xml or build.gradle
  ```


## Affected products

- org.infinispan:infinispan-core (Maven) ECOSYSTEM:introduced=0,fixed=9.4.15.Final

## Identifiers

- CVE-2019-10158
- GHSA-6x3v-rw2q-9gx7

## Related threats

- [Infinispan caches credentials in clear text](https://junglewise.ai/threats/cve-2023-5384-infinispan-caches-credentials-in-clear-text)
- [Use of Externally-Controlled Input to Select Classes or Code in Infinispan](https://junglewise.ai/threats/cve-2019-10174-use-of-externally-controlled-input-to-select-classes-or-code-in)
- [Deserialization of Untrusted Data in Infinispan](https://junglewise.ai/threats/cve-2017-15089-deserialization-of-untrusted-data-in-infinispan)
- [Infinispan Hot Rod Java client insecure deserialization](https://junglewise.ai/threats/cve-2016-0750-infinispan-hot-rod-java-client-insecure-deserialization)
- [Deserialization of Untrusted Data in Infinispan](https://junglewise.ai/threats/cve-2018-1131-deserialization-of-untrusted-data-in-infinispan)