apache-karaf CVEs · Medium

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 100.0%

Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Nov 171 No exploit published1 Medium1 not blocked1 No public exploit1 Dec 170 Jan 180 Feb 181 No exploit published1 Medium1 not blocked1 No public exploit1

Nov 17Dec 17Jan 18Feb 18

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2016-8750	Medium	2018-02-19	No exploit published	No public exploit	Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
CVE-2014-0219	Medium	2017-11-15	No exploit published	No public exploit	Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2016-8750

Medium

2018-02-19

No exploit published

No public exploit

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.

CVE-2014-0219

Medium

2017-11-15

No exploit published

No public exploit

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.