Description
Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
Scores
CVSS v3
6.5
EPSS
0.0151
EPSS Percentile
81.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-90
Status
published
Products (2)
apache/karaf
< 4.0.8
org.apache.karaf/apache-karaf
0 - 4.0.8Maven
Published
Feb 19, 2018
Tracked Since
Feb 18, 2026