CVE-2018-11788: XEE
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-11788?
CVE-2018-11788 is a vulnerability found in Apache Karaf, which allows XXE attacks through the features deployer.
What is the severity of CVE-2018-11788?
CVE-2018-11788 has a severity score of 9.8, which is considered critical.
How does CVE-2018-11788 affect Apache Karaf?
CVE-2018-11788 affects Apache Karaf versions up to 4.1.7 and 4.2.2, allowing XXE attacks through the features deployer.
What is an XXE attack?
An XXE attack is an XML External Entity attack, where an attacker can exploit an XML parsing vulnerability to disclose sensitive information or execute arbitrary code.
How can I fix CVE-2018-11788?
To fix CVE-2018-11788, upgrade to Apache Karaf version 4.1.7 or 4.2.2, which contain mitigation codes against XXE attacks.