EUVD-2025-21327
GHSA-44c3-38h8-9fh9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 4 maven packages depend on org.apache.jackrabbit:jackrabbit-core (4 direct, 0 indirect)
- 34 maven packages depend on org.apache.jackrabbit:jackrabbit-spi-commons (13 direct, 21 indirect)
Ecosystem-wide dependent count for version 2.23.0-beta and other introduced versions.
DescriptionCVE.org
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges.
Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Java 11, beta versions), which fix this issue. Earlier versions (up to 2.20.16) are not supported anymore, thus users should update to the respective supported version.
AnalysisAI
Apache Jackrabbit versions prior to 2.23.2 contain blind XXE (XML External Entity) vulnerabilities in jackrabbit-spi-commons and jackrabbit-core components due to unsafe XML document parsing when loading privilege definitions. An authenticated attacker with low privileges can exploit this to achieve high-impact confidentiality, integrity, and availability compromise. The vulnerability requires user authentication (PR:L) but has no interaction requirement and affects all systems regardless of scope.
Technical ContextAI
The vulnerability exists in Apache Jackrabbit's privilege loading mechanism, which utilizes unsecured XML document builders (likely using DOM or SAX parsers without XXE protections disabled). Jackrabbit is a Java Content Repository implementation following the JCR specification, widely used for content management and document storage. The root cause is CWE-611 (Improper Restriction of XML External Entity Reference), where the XML parser processes external entity declarations without proper validation or DTD processing restrictions. Affected components are jackrabbit-spi-commons (SPI layer) and jackrabbit-core (core repository), indicating the vulnerability affects the foundational XML deserialization during privilege configuration/loading. This is a blind XXE variant, meaning the attacker cannot directly exfiltrate data but can read files, perform SSRF attacks, or cause denial of service through billion laughs/XML bomb attacks.
RemediationAI
{'type': 'Immediate Patch', 'action': 'Upgrade to one of the following supported versions based on your Java runtime: Apache Jackrabbit 2.20.17 (for Java 8 environments, though Java 8 is EOL), 2.22.1 (for Java 11), or 2.23.2 (for Java 11, recommended for new deployments).'} {'type': 'Configuration Mitigation (if patch cannot be immediately applied)', 'action': "Restrict XML privilege source to trusted, internal systems only. Implement network-level access controls to limit which systems can load privilege definitions. Disable external DTD processing at the JVM level using system properties: -Dcom.sun.org.apache.xerces.internal.XMLConstants.ACCESS_EXTERNAL_DTD='' and -Dcom.sun.org.apache.xerces.internal.XMLConstants.ACCESS_EXTERNAL_SCHEMA=''."} {'type': 'Access Control', 'action': 'Audit and minimize the number of accounts with privilege administration or content repository configuration rights, as exploitation requires authentication.'} {'type': 'Verification', 'action': 'After patching, verify the XML parser configuration in privilege loading code uses XXE-safe defaults (e.g., XMLInputFactory with FEATURE_SECURE_PROCESSING enabled, DTDProcessing.PROHIBIT, or equivalent hardening).'} {'type': 'Vendor Advisory', 'action': 'Refer to Apache Jackrabbit security advisory at https://jackrabbit.apache.org/security-advisories.html for detailed patch notes and breaking changes.'}
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | needs-triage | - |
| questing | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
Debian
Bug #1109335| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 2.18.0+r2.14.6-1 | - |
| bookworm | vulnerable | 2.20.3-1 | - |
| forky, sid, trixie | fixed | 2.20.11-1.1 | - |
| (unstable) | fixed | 2.20.11-1.1 | unimportant |
Share
External POC / Exploit Code
Leaving vuln.today