CVE-2018-11788

CVE-2018-11788: falha em Apache Karaf

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Karaf+ Monitorar org.apache.karaf.specs:org.apache.karaf.specs.java.xml

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 7.3%
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Produtos afetados
Apache Software Foundation · Apache Karaf
CVEs relacionadas — Apache Karaf

No mesmo produto, das mais perigosas para as menos.

CVE-2016-8750—CVE-2016-8750EPSS 5.2%CVE-2022-22932—Path traversal flawsEPSS 2.8%CVE-2022-40145CRITICALApache Karaf: JDBC JAAS LDAP injectionEPSS 2.6%CVE-2018-11787—CVE-2018-11787EPSS 2.6%CVE-2021-41766—Insecure Java Deserialization in Apache KarafEPSS 2.0%CVE-2018-11786—CVE-2018-11786EPSS 1.9%