Critical severity · published Jan 7, 2019
CVE-2018-11788
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder
9.8
CVSS
7.3%
EPSS
No
On KEV
Description
Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
Karaf · Apache
before 4.1.7; 4.2.0 through 4.2.1; 4.2.0; 4.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-11788
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-11788
Vendor Advisory
http://karaf.apache.org/security/cve-2018-11788.txt
Third Party Advisory
http://www.securityfocus.com/bid/106479
More from Karaf
9.8
CVE-2026-91048
Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
9.8
CVE-2026-91012
Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
9.8
CVE-2022-40145
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL
8.8
CVE-2026-92142
Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
8.8
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)