1. Home
  2. CVE Database
  3. CVE-2019-0226
MEDIUM · 4.9

CVE-2019-0226

Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process us...

Vulnerability Description

Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. User should upgrade to Apache Karaf 4.2.5 or later.

CVSS Score

4.9

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
ApacheKaraf< 4.2.5

Related Weaknesses (CWE)

CWE-22

References

FAQ

What is CVE-2019-0226?

CVE-2019-0226 is a vulnerability with a CVSS score of 4.9 (MEDIUM). Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process us...

How severe is CVE-2019-0226?

CVE-2019-0226 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-0226?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Karaf.