Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-t51u-cxu5-kfhr
Vulnerability ID VCID-t51u-cxu5-kfhr
Aliases CVE-2018-11788
GHSA-92wj-x78c-m4fx
Summary
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-611 Improper Restriction of XML External Entity Reference
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 9.8 http://karaf.apache.org/security/cve-2018-11788.txt
generic_textual CRITICAL http://karaf.apache.org/security/cve-2018-11788.txt
cvssv3 7.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11788.json
epss 0.24747 https://api.first.org/data/v1/epss?cve=CVE-2018-11788
epss 0.24747 https://api.first.org/data/v1/epss?cve=CVE-2018-11788
epss 0.24747 https://api.first.org/data/v1/epss?cve=CVE-2018-11788
epss 0.24747 https://api.first.org/data/v1/epss?cve=CVE-2018-11788
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-92wj-x78c-m4fx
cvssv3.1 9.8 https://github.com/apache/karaf
generic_textual CRITICAL https://github.com/apache/karaf
cvssv3.1 9.8 https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca
generic_textual CRITICAL https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2018-11788
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2018-11788
cvssv3.1 9.8 https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479
generic_textual CRITICAL https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11788.json
https://api.first.org/data/v1/epss?cve=CVE-2018-11788
https://github.com/apache/karaf
https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafc
https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca
https://github.com/apache/karaf/commit/1ffa6d1c4555cab9737d76b49142528b57cfdfc
https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479
https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479/
http://www.securityfocus.com/bid/106479
1663857 https://bugzilla.redhat.com/show_bug.cgi?id=1663857
CVE-2018-11788 https://nvd.nist.gov/vuln/detail/CVE-2018-11788
CVE-2018-11788.TXT http://karaf.apache.org/security/cve-2018-11788.txt
GHSA-92wj-x78c-m4fx https://github.com/advisories/GHSA-92wj-x78c-m4fx
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://karaf.apache.org/security/cve-2018-11788.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11788.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/karaf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/apache/karaf/commit/0c36c50bc158739c8fc8543122a6740c54adafca
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-11788
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20200227101219/https://www.securityfocus.com/bid/106479
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.96268
EPSS Score 0.24747
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:20:06.477246+00:00 ProjectKB MSRImporter Import https://raw.githubusercontent.com/SAP/project-kb/master/MSR2019/dataset/vulas_db_msr2019_release.csv 38.6.0