jackrabbit

7 results · Feed

• Medium 6.9
  CVE-2026-92415

  Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

  — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes fr…

  Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu
  Oct 7, 2026
• Critical 9.3
  CVE-2026-92414

  Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

  : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issu…

  Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu
  Oct 7, 2026
• Medium 6.5
  CVE-2025-58782

  Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory

  Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accep…

  Apache Software Foundation Apache Jackrabbit JCR Commons Apache Jackrabbit Core jackrabbit Debian Ubuntu Maven
  Sep 8, 2025
• High 8.8
  CVE-2025-53689

  Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons

  Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Ja…

  Apache Software Foundation Apache Jackrabbit jackrabbit jackrabbit Debian Ubuntu Maven
  Jul 14, 2025
• Critical 9.8
  CVE-2023-37895

  Apache Jackrabbit RMI access can lead to RCE

  Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which co…

  Apache Software Foundation Apache Jackrabbit Standalone (jackrabbit-standalone and jackrabbit-standalone-components) Apache Jackrabbit Webapp (jackrabbit-webapp) jackrabbit Debian Ubuntu Maven
  Jul 25, 2023
• High 8.8
  CVE-2016-6801

  Apache Jackrabbit Authentication Hijacking Vulnerability

  Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows re…

  jackrabbit jackrabbit org.apache.jackrabbit:jackrabbit-webdav Debian Ubuntu Maven
  Sep 21, 2016
• Medium —
  CVE-2015-1833 Public exploit EPSS 56%

  Improper Input Validation in Apache Jackrabbit

  XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet …

  jackrabbit jackrabbit org.apache.jackrabbit:jackrabbit-core Debian Ubuntu Maven
  May 29, 2015