Lucene search

Veracode Vulnerability DatabaseVERACODE:46936

HistoryMay 15, 2024 - 10:47 a.m.

Server-side Request Forgery

2024-05-1510:47:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

server-side request forgery

input validation

unauthorized requests

sensitive data

internal systems

software

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

org.apache.karaf, cave is vulnerable to Server-side Request Forgery. The vulnerability is due to improper input validation, which allows attackers to manipulate the server into making unauthorized requests to internal services, potentially accessing sensitive data or interacting with internal systems without proper authorization.

CPENameOperatorVersion
apache karaf :: cavele4.2.1
apache karaf :: cavele4.2.1

CPE	Name	Operator	Version
	apache karaf :: cave	le	4.2.1
	apache karaf :: cave	le	4.2.1

References

www.openwall.com/lists/oss-security/2024/05/09/5

github.com/advisories/GHSA-338x-hfx8-vx9x

karaf.apache.org/security/cve-2024-34365.txt