Miggo Logo
Miggo Vulnerability Database
→
CVE-2014-0219

CVE-2014-0219: Improper Input Validation in Apache Karaf

5.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2014-0219
GHSA ID
GHSA-m6g3-xq5q-4hg9
EPSS Score
0.24678%
CWE
CWE-20
Published
5/14/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.karaf:apache-karafmaven< 4.0.104.0.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from Karaf's shutdown port being exposed on loopback without proper access controls. The ShutdownSocketHandler.run method is the entry point for processing shutdown commands via socket. The advisory explicitly references this component in its fix description, and runtime exploitation would manifest in stack traces showing this method handling unauthorized shutdown requests. The lack of input validation for the shutdown command in this function matches the CWE-20 classification.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*p**** K*r** ***or* *.*.** *n**l*s * s*ut*own port on t** loop***k int*r****, w*i** *llows lo**l us*rs to **us* * **ni*l o* s*rvi** (s*ut*own) *y s*n*in* * s*ut*own *omm*n* to *ll list*nin* *i** ports.

Reasoning

T** vuln*r**ility st*ms *rom K*r**'s s*ut*own port **in* *xpos** on loop***k wit*out prop*r ****ss *ontrols. T** `S*ut*ownSo*k*t**n*l*r.run` m*t*o* is t** *ntry point *or pro**ssin* s*ut*own *omm*n*s vi* so*k*t. T** **visory *xpli*itly r***r*n**s t*i