JAAS Authentication Vulnerability in Apache Karaf
CVE-2020-11980

6.3MEDIUM

Key Information:

Vendor
Apache
Status
Apache Karaf
Vendor
CVE Published:
12 June 2020

Summary

The vulnerability in Apache Karaf's JMX authentication mechanism allows a user with a 'viewer' role to potentially invoke specific actions. Despite lacking the permission to invoke on MBeans, the viewer role can exploit this weakness to conduct Server Side Request Forgery (SSRF) attacks, enabling them to pollute the MBean registry and potentially escalate privileges. This can compromise the integrity of the system. It is recommended that users implement access control lists (ACLs) to restrict unauthorized access and upgrade to Apache Karaf 4.2.9 or later.

Affected Version(s)

Apache Karaf Apache Karaf up to 4.2.8

References

http://karaf.apache.org/security/cve-2020-11980.txt
x_refsource_MISC

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.