Description
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jackrabbit | 2.10.1-1 | — |
| Debian 13 | jackrabbit | 2.10.1-1 | — |
| Debian 12 | jackrabbit | 2.10.1-1 | — |
| Debian 8 | jackrabbit | 2.3.6-1+deb8u1 | DSA-3298-1 |
| Debian 7 | jackrabbit | 2.3.6-1+deb7u1 | DSA-3298-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | jackrabbit | 2.3.6-1+deb8u1build0.14.04.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Apache JackRabbit - WebDAV XML External Entity EDB-37110 · webapps · May 26, 2015
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.jackrabbit:jackrabbit-core | < 2.0.6 | 2.0.6 | GHSA-9284-j4c9-779q |
| Maven | org.apache.jackrabbit:jackrabbit-core | >= 2.2.0, < 2.2.14 | 2.2.14 | GHSA-9284-j4c9-779q |
| Maven | org.apache.jackrabbit:jackrabbit-core | >= 2.4.0, < 2.4.6 | 2.4.6 | GHSA-9284-j4c9-779q |
| Maven | org.apache.jackrabbit:jackrabbit-core | >= 2.6.0, < 2.6.6 | 2.6.6 | GHSA-9284-j4c9-779q |
| Maven | org.apache.jackrabbit:jackrabbit-core | >= 2.8.0, < 2.8.1 | 2.8.1 | GHSA-9284-j4c9-779q |
| Maven | org.apache.jackrabbit:jackrabbit-core | >= 2.10.0, < 2.10.1 | 2.10.1 | GHSA-9284-j4c9-779q |
Advisories 1
- DSA-3298-1 jackrabbit - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-3298 vendor-advisory
- 74761 vdb-entry
- 37110 exploit
- [jackrabbit-announce] 20150521 CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability) mailing-list
- 20150521 CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability) mailing-list
- http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt
- https://issues.apache.org/jira/browse/JCR-3883
- http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html