Detections
Analytics
SCA: security update for org.apache.karaf:apache-karaf (GHSA-9448-c9wq-jg9v)
high Tenable Self-Hosted Container Security Plugin ID 422010
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can
manage the running instance, any user with rights to the Karaf console can pivot and read/write any file
on the file system to which the Karaf process user has access. This can be locked down a bit by using
chroot to change the root directory to protect files outside of the Karaf install directory; it can be
further locked down by defining a security manager policy that limits file system access to those
directories beneath the Karaf home that are necessary for the system to run. However, this still allows
anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process
user. (CVE-2018-11786)
See Also
Plugin Details
Severity: High
ID: 422010
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 3/28/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2018-11786
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 12/21/2018
Vulnerability Publication Date: 9/18/2018
Reference Information
CVE: CVE-2018-11786
cwe: CWE-269