CVE-2018-11788
XML External Entity Reference in Apache Karaf
9.8
CRITICAL
CVSS 3.1
EPSS 7.5%
描述
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
如何修補 CVE-2018-11788
要修補 CVE-2018-11788,請將受影響套件升級到下列已修補版本。
- —升級至 4.2.2 或更新版本
CVE-2018-11788 正在被利用嗎?
中等 — EPSS 為 7.5%,可持續追蹤但非最高優先。
受影響套件(1)
- >= 4.2.0, < 4.2.2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |