CVE-2018-11788
published 2019-01-07CVE-2018-11788: Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features…
PriorityP352critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
7.48%
93.8th percentile
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | karaf | < 4.1.7 | 4.1.7 |
| apache | karaf | — | — |
| apache | karaf | 4.2.0 – 4.2.1 | — |
| apache_software_foundation | apache_karaf | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
XML External Entity Reference in Apache Karaf
osv·2019-01-07
CVE-2018-11788 [CRITICAL] XML External Entity Reference in Apache Karaf
XML External Entity Reference in Apache Karaf
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
GHSA
XML External Entity Reference in Apache Karaf
ghsa·2019-01-07
CVE-2018-11788 [CRITICAL] CWE-611 XML External Entity Reference in Apache Karaf
XML External Entity Reference in Apache Karaf
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Red Hat
karaf: XML external entity processing
vendor_redhat·2019-01-06·CVSS 9.8
CVE-2018-11788 [CRITICAL] CWE-611 karaf: XML external entity processing
karaf: XML external entity processing
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
A flaw was found in the Apache Karaf XMLInputFactory, where it does not prevent External Entity Processing (XXE). This is a potential security risk as an attacker could inject external XML entities to access sensitive information or conduct further attacks.
Statement: Red Hat OpenStack Pl
No detection rules found.
No public exploits indexed.
2019-01-07
Published