CVE-2017-15089

CVE-2017-15089 describes a critical deserialization vulnerability in the Hotrod client of Infinispan versions prior to 9.2.0.CR1. An authenticated attacker can inject a malicious object into the data cache, leading to unsafe deserialization on the client and potential further attacks. With a CVSS score of 8.8 (High), this vulnerability allows for high impact to confidentiality, integrity, and availability with low attack complexity and no user interaction required. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the inherent risk remains significant.