{"cve":"CVE-2020-11980","nvd":{"published":"2020-06-12T22:15:11.473","modified":"2026-06-17T02:51:10.907","status":"Modified","description":"In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an \"admin\" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a \"viewer\" role. In the 'etc/jmx.acl.cfg', such as role can call get*. It's possible to authenticate as a viewer role + invokes on the MLet getMBeansFromURL method, which goes off to a remote server to fetch the desired MBean, which is then registered in Karaf. At this point the attack fails as \"viewer\" doesn't have the permission to invoke on the MBean. Still, it could act as a SSRF style attack and also it essentially allows a \"viewer\" role to pollute the MBean registry, which is a kind of privilege escalation. The vulnerability is low as it's possible to add a ACL to limit access. Users should update to Apache Karaf 4.2.9 or newer.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cwes":["CWE-918"],"references":["http://karaf.apache.org/security/cve-2020-11980.txt","http://karaf.apache.org/security/cve-2020-11980.txt"],"products":["apache:karaf"],"source":"nvd","synced_at":"2026-10-19T21:05:42.039641217+00:00"},"epss":{"cve":"CVE-2020-11980","score":0.01876,"percentile":0.79412,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-9jg9-6wm2-x7p5","url":"https://osv.dev/vulnerability/GHSA-9jg9-6wm2-x7p5","summary":"Server-Side Request Forgery in Karaf","modified":"2024-02-16T08:02:57.416527Z","packages":[{"ecosystem":"Maven","name":"org.apache.karaf.management:org.apache.karaf.management.server","purl":"pkg:maven/org.apache.karaf.management/org.apache.karaf.management.server","ranges":["<4.2.9"],"fixed":["4.2.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}