CVE-2018-11788GHSA-92WJ-X78C-M4FX
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy fol
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.2.2, 4.1.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Software Foundation Apache Karaf
Version range not reported
- org.apache.karaf.specs:org.apache.karaf.specs.java.xmlMaven
From 4.2.0 · fixed in 4.2.2
- org.apache.karaf.specs:org.apache.karaf.specs.java.xmlMaven
fixed in 4.1.7