Not rated
CVE-2018-11788 Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file…
Description
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Karaf | Versions not published |
References
- karaf.apache.org karaf.apache.org
- 106479 www.securityfocus.com
Timeline
- Published
- Last modified
Other CVEs of Apache Karaf
The 15 CVEs of Apache Karaf →
CVE-2026-92142
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC)…
Not rated
CVE-2026-91085
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files…
Not rated
CVE-2026-91048
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg
Not rated
CVE-2026-91012
org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the…
Not rated