Skip to main content

Karaf CVE-2017-1000406

HIGH
7PK - Security Features (CWE-254)
2017-11-30 cve@mitre.org
Information Disclosure Karaf
7.5
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Nov 30, 2017 - 21:29 cve.org
HIGH 7.5

DescriptionCVE.org

OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleared (e.g. via restart).

AnalysisAI

OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleared (e.g. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-254. OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used until the Karaf cache is manually cleared (e.g. via restart). Affected products include: Opendaylight Karaf.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Karaf

View all
CVE-2020-28052 HIGH POC
8.1 Dec 18

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulne
CVE-2022-40145 CRITICAL
9.8 Dec 21

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the

CVE-2018-11786 HIGH
8.8 Sep 18

In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the runni
CVE-2018-11787 HIGH
8.1 Sep 18

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available
CVE-2019-0191 MEDIUM
6.5 Mar 21

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in

CVE-2020-11980 MEDIUM
6.3 Jun 12

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. Rated medium severity
CVE-2014-0219 MEDIUM
5.5 Nov 15

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial
CVE-2019-0226 MEDIUM
4.9 May 09

Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directo

Same weakness CWE-254 – 7PK - Security Features

View all
CVE-2015-1158 CRITICAL POC
10.0
CVE-2016-2296 CRITICAL POC
9.4
CVE-2016-2118 HIGH POC
7.5
CVE-2015-1793 MEDIUM POC
6.5
CVE-2015-3693 CRITICAL POC
9.3
CVE-2016-0128 MEDIUM
6.8
CVE-2016-10178 CRITICAL POC
9.8
CVE-2015-8286 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2017-1000406 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy