CVE-2015-1833
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
- EPSS
- 56% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:jackrabbit
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9284-j4c9-779q | Maven | org.apache.jackrabbit:jackrabbit-core | <2.0.6 | 2.0.6 |
| GHSA-9284-j4c9-779q | Maven | org.apache.jackrabbit:jackrabbit-core | >=2.2.0 <2.2.14 | 2.2.14 |
| GHSA-9284-j4c9-779q | Maven | org.apache.jackrabbit:jackrabbit-core | >=2.4.0 <2.4.6 | 2.4.6 |
| GHSA-9284-j4c9-779q | Maven | org.apache.jackrabbit:jackrabbit-core | >=2.6.0 <2.6.6 | 2.6.6 |
| GHSA-9284-j4c9-779q | Maven | org.apache.jackrabbit:jackrabbit-core | >=2.8.0 <2.8.1 | 2.8.1 |
| GHSA-9284-j4c9-779q | Maven | org.apache.jackrabbit:jackrabbit-core | >=2.10.0 <2.10.1 | 2.10.1 |
References
- http://mail-archives.apache.org/mod_mbox/jackrabbit-announce/201505.mbox/%3C555DA644.8080908%40greenbytes.de%3E
- http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html
- http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt
- http://www.debian.org/security/2015/dsa-3298
- http://www.securityfocus.com/archive/1/535582/100/0/threaded