CVE-2018-11787 (GCVE-0-2018-11787)

Vulnerability from cvelistv5 – Published: 2018-09-18 14:00 – Updated: 2024-09-17 02:16
VLAI
Summary
In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised.
Severity
8.1 (High)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • Unsecure Access
Assigner
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Karaf Affected: prior to 3.0.9
Affected: 4.0.x prior to 4.0.9
Affected: 4.1.x prior to 4.1.1
guessed Create a notification for this product.
Date Public
2018-09-18 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:17:09.210Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/browse/KARAF-4993"
          },
          {
            "name": "[karaf-dev] 20180918 [SECURITY] New security advisory for CVE-2018-11787 released for Apache Karaf",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c%40%3Cdev.karaf.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://karaf.apache.org/security/cve-2018-11787.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Karaf",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 3.0.9"
            },
            {
              "status": "affected",
              "version": "4.0.x prior to 4.0.9"
            },
            {
              "status": "affected",
              "version": "4.1.x prior to 4.1.1"
            }
          ]
        }
      ],
      "datePublic": "2018-09-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unsecure Access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-18T13:57:02.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/jira/browse/KARAF-4993"
        },
        {
          "name": "[karaf-dev] 20180918 [SECURITY] New security advisory for CVE-2018-11787 released for Apache Karaf",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c%40%3Cdev.karaf.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://karaf.apache.org/security/cve-2018-11787.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2018-09-18T00:00:00",
          "ID": "CVE-2018-11787",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Karaf",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "prior to 3.0.9"
                          },
                          {
                            "version_value": "4.0.x prior to 4.0.9"
                          },
                          {
                            "version_value": "4.1.x prior to 4.1.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Unsecure Access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://issues.apache.org/jira/browse/KARAF-4993",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/jira/browse/KARAF-4993"
            },
            {
              "name": "[karaf-dev] 20180918 [SECURITY] New security advisory for CVE-2018-11787 released for Apache Karaf",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c@%3Cdev.karaf.apache.org%3E"
            },
            {
              "name": "http://karaf.apache.org/security/cve-2018-11787.txt",
              "refsource": "CONFIRM",
              "url": "http://karaf.apache.org/security/cve-2018-11787.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2018-11787",
    "datePublished": "2018-09-18T14:00:00.000Z",
    "dateReserved": "2018-06-05T00:00:00.000Z",
    "dateUpdated": "2024-09-17T02:16:58.807Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2018-11787",
      "date": "2026-09-20",
      "epss": "0.02573",
      "percentile": "0.84479"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "82165825-B96D-467A-A9D1-76F01443D630",
                    "versionEndExcluding": "3.0.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4A4EB9-65E6-4F63-8DF6-6C03A9BFAF98",
                    "versionEndExcluding": "4.0.9",
                    "versionStartIncluding": "4.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D9108CB-DCB5-40DB-889C-26EDB0041342",
                    "versionEndExcluding": "4.1.1",
                    "versionStartIncluding": "4.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:karaf:4.0.0:milestone1:*:*:*:*:*:*",
                    "matchCriteriaId": "4C7A0D73-11F9-430A-8E03-49D1E1301777",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:karaf:4.0.0:milestone2:*:*:*:*:*:*",
                    "matchCriteriaId": "37C8767D-D455-452F-B27E-C3A531F1C50F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:karaf:4.0.0:milestone3:*:*:*:*:*:*",
                    "matchCriteriaId": "C2A2C83C-6939-4E12-AF43-6932B58C584F",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised."
          },
          {
            "lang": "es",
            "value": "En Apache Karaf en versiones anteriores a la 3.0.9, 4.0.9 y 4.1.1, cuando la caracter\u00edstica webconsole est\u00e1 instalada en Karaf, est\u00e1 disponible en .../system/console y requiere autenticaci\u00f3n para acceder a ella. Una parte de la consola es un shell/consola Gogo que otorga acceso a la consola de l\u00ednea de comandos de Karaf mediante un navegador web y, cuando se navega hasta ella, est\u00e1 disponible en .../system/console/gogo. Intentar acceder directamente a esa URL requiere autenticaci\u00f3n. Un paquete opcional empleado por algunas aplicaciones es Pax Web Extender Whiteboard, que forma parte de la caracter\u00edstica pax-war y tal vez de otras. Cuando est\u00e1 instalada, la consola Gogo se vuelve disponible en otra URL../gogo/, y esa URL no es segura, lo que otorga acceso a la consola Karaf a usuarios no autenticados. Una mitigaci\u00f3n a este problema es detener/desinstalar manualmente el paquete del plugin Gogo que est\u00e1 instalado con la funcionalidad webconsole, aunque esto elimina la consola de la aplicaci\u00f3n en .../system/console, no solo del endpoint sin autenticar. Tambi\u00e9n se podr\u00eda detener/desinstalar Pax Web Extender Whiteboard, pero otros componentes/aplicaciones podr\u00edan necesitarlo y, por lo tanto, su funcionalidad se ver\u00eda reducida/comprometida."
          }
        ],
        "id": "CVE-2018-11787",
        "lastModified": "2024-11-21T03:44:02.313",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.0"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2018-09-18T14:29:00.620",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://karaf.apache.org/security/cve-2018-11787.txt"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://issues.apache.org/jira/browse/KARAF-4993"
          },
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c%40%3Cdev.karaf.apache.org%3E"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://karaf.apache.org/security/cve-2018-11787.txt"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://issues.apache.org/jira/browse/KARAF-4993"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c%40%3Cdev.karaf.apache.org%3E"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T16:10:24+00:00",
      "cve": "CVE-2018-11787",
      "id": "CVE-2018-11787",
      "initial_release_date": "2018-09-18T00:00:00+00:00",
      "product_status:known_affected": "7",
      "product_status:known_not_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "karaf: Authentication bypass access to Gogo shell in the webconsole",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-11787.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.