-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from Karaf's shutdown port being exposed on loopback without proper access controls. The ShutdownSocketHandler.run method is the entry point for processing shutdown commands via socket. The advisory explicitly references this component in its fix description, and runtime exploitation would manifest in stack traces showing this method handling unauthorized shutdown requests. The lack of input validation for the shutdown command in this function matches the CWE-20 classification.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.karaf:apache-karaf | maven | < 4.0.10 | 4.0.10 |
Ongoing coverage of React2Shell