CVE-2018-1335: Command Injection
Apache Tika before version 1.18 has a command injection vulnerability in tika-server. A remote attacker could exploit this to execute arbitrary commands via crafted headers.
External References:
https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca@%3Cdev.tika.apache.org%3E
Other sources
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-1335?
CVE-2018-1335 is a vulnerability in Apache Tika versions 1.7 to 1.17 that allows clients to inject commands into the command line of the server running tika-server.
What is the severity of CVE-2018-1335?
CVE-2018-1335 has a severity level of critical with a CVSS score of 8.8.
How does CVE-2018-1335 affect Apache Tika?
CVE-2018-1335 affects Apache Tika versions 1.7 to 1.17.
How can I fix CVE-2018-1335?
To fix CVE-2018-1335, upgrade to Apache Tika version 1.18 or later.
Is CVE-2018-1335 a remote code execution vulnerability?
Yes, CVE-2018-1335 allows remote attackers to execute arbitrary commands on the server running tika-server.