Non notée
CVE-2018-11788 Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file…
Description
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Karaf | Versions non publiées |
Références
- karaf.apache.org karaf.apache.org
- 106479 www.securityfocus.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Karaf
Les 15 CVE de Apache Karaf →
CVE-2026-92142
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC)…
Non notée
CVE-2026-91085
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files…
Non notée
CVE-2026-91048
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg
Non notée
CVE-2026-91012
org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the…
Non notée