CVE-2024-34365

CVE-2024-34365: Apache Karaf Cave: Cave SSRF and arbitrary file access

Vendor Apache Software Foundation

Product Apache Karaf Cave

Weakness CWE-20 · Input validation

Published May 9, 2024

Last update February 13, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Key dates

02Disclosure timeline

May 9, 2024 CVE published

February 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-34365 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/20.html AskarLabs — CWE-20 write-up Improper Input Validation

Related vulnerabilities

04Related CVE

CVE-2025-12842 Booking Plugin for WordPress Appointments – Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending CVE-2024-0710 GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID Modification CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla CVE-2026-4987 SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' CVE-2025-1514 Active Products Tables for WooCommerce <= 1.0.6.7 - Unauthenticated Arbitrary Filter Call