Skip to content

Vendor

org.apache.karaf.management vulnerabilities

2 published CVES affecting org.apache.karaf.management, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of org.apache.karaf.management alerts

Products

Latest org.apache.karaf.management CVEs

Newest publication first

  1. CVE-2021-41766 Insecure Java Deserialization in Apache Karaf

    Published
    HighCVSS 8.1 EPSS 2.0%

    Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against...

  2. CVE-2020-11980 Server-Side Request Forgery in Karaf

    Published
    MediumCVSS 6.3 EPSS 1.9%

    In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.