High WID-SEC-2023-1883 1 CVE

Apache Jackrabbit Oak: Schwachstelle ermöglicht Codeausführung

Published Jul 25, 2023 · Updated Jul 25, 2023 · de-DE

Vendor: Apache Product: Jackrabbit Product: Jackrabbit Oak < 2.20.11 Product: Jackrabbit Oak < 2.21.18

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Jackrabbit Oak ausnutzen, um beliebigen Programmcode auszuführen.

Product

Apache Jackrabbit Oak ist ein freies Content-Repository für die Java-Plattform.

Vulnerabilities 1

Critical 9.8

CVE-2023-37895

Apache Jackrabbit RMI access can lead to RCE

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which co…

Apache Software Foundation Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components) Apache Jackrabbit Webapp (jackrabbit-webapp) jackrabbit Debian Ubuntu Maven

Jul 25, 2023

Revision history

2023-07-25 #1
Initiale Fassung

References

GitHub Security Advisory - Apache Jackrabbit - GHSA-q8cm-3v62-jj79 vom 2023-07-25
https://github.com/advisories/GHSA-q8cm-3v62-jj79