CVE-2018-11787
First published: Tue Sep 18 2018(Updated: )
In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Karaf | <3.0.9 | |
| Apache Karaf | >=4.0.0<4.0.9 | |
| Apache Karaf | >=4.1.0<4.1.1 | |
| Apache Karaf | =4.0.0-milestone1 | |
| Apache Karaf | =4.0.0-milestone2 | |
| Apache Karaf | =4.0.0-milestone3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://karaf.apache.org/security/cve-2018-11787.txt
- https://issues.apache.org/jira/browse/KARAF-4993
- https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c@%3Cdev.karaf.apache.org%3E
- https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c%40%3Cdev.karaf.apache.org%3E
Frequently Asked Questions
What is CVE-2018-11787?
CVE-2018-11787 is a vulnerability in Apache Karaf versions prior to 3.0.9, 4.0.9, and 4.1.1.
How severe is CVE-2018-11787?
CVE-2018-11787 has a severity rating of 8.1 (high).
What is the affected software?
Apache Karaf versions prior to 3.0.9, 4.0.9, and 4.1.1 are affected.
How can I fix CVE-2018-11787?
To fix CVE-2018-11787, update Apache Karaf to version 3.0.9, 4.0.9, or 4.1.1.
Where can I find more information about CVE-2018-11787?
You can find more information about CVE-2018-11787 at the following links: [http://karaf.apache.org/security/cve-2018-11787.txt](http://karaf.apache.org/security/cve-2018-11787.txt), [https://issues.apache.org/jira/browse/KARAF-4993](https://issues.apache.org/jira/browse/KARAF-4993), [https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c@%3Cdev.karaf.apache.org%3E](https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c@%3Cdev.karaf.apache.org%3E).
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/event
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/apache
- canonical/apache karaf
- version/apache karaf/4.0.0
- version/apache karaf/4.1.0
- version/apache karaf/4.0.0-milestone1
- version/apache karaf/4.0.0-milestone2
- version/apache karaf/4.0.0-milestone3