XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before…
Priority MEDIUM 62CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.
Summary
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Why it matters now
EPSS 0.55949 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed org.apache.jackrabbit:jackrabbit-core (Maven): 2.0.6, 2.2.14, 2.4.6 +3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | before 2.0.6 | 2.0.6 | Patch available | GHSA-9284-j4c9-779q |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | 2.2.0 to before 2.2.14 | 2.2.14 | Patch available | GHSA-9284-j4c9-779q |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | 2.4.0 to before 2.4.6 | 2.4.6 | Patch available | GHSA-9284-j4c9-779q |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | 2.6.0 to before 2.6.6 | 2.6.6 | Patch available | GHSA-9284-j4c9-779q |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | 2.8.0 to before 2.8.1 | 2.8.1 | Patch available | GHSA-9284-j4c9-779q |
| — | org.apache.jackrabbit:jackrabbit-core (Maven) | 2.10.0 to before 2.10.1 | 2.10.1 | Patch available | GHSA-9284-j4c9-779q |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected before 2.0.6 Fixed in 2.0.6 Patch available GHSA-9284-j4c9-779q
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 2.2.0 to before 2.2.14 Fixed in 2.2.14 Patch available GHSA-9284-j4c9-779q
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 2.4.0 to before 2.4.6 Fixed in 2.4.6 Patch available GHSA-9284-j4c9-779q
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 2.6.0 to before 2.6.6 Fixed in 2.6.6 Patch available GHSA-9284-j4c9-779q
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 2.8.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-9284-j4c9-779q
- org.apache.jackrabbit:jackrabbit-core (Maven) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-9284-j4c9-779q
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:* | up to 2.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.2:*:*:*:*:*:*:* | 2.2.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.4:*:*:*:*:*:*:* | 2.2.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.5:*:*:*:*:*:*:* | 2.2.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.7:*:*:*:*:*:*:* | 2.2.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.8:*:*:*:*:*:*:* | 2.2.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.9:*:*:*:*:*:*:* | 2.2.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.10:*:*:*:*:*:*:* | 2.2.10 | Vulnerable | Apache |
- cpe:2.3:a:apache:jackrabbit:*:*:*:*:*:*:*:* Versions up to 2.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·Apache
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:jackrabbit:2.2.11:*:*:*:*:*:*:* | 2.2.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.12:*:*:*:*:*:*:* | 2.2.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.2.13:*:*:*:*:*:*:* | 2.2.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.4.0:*:*:*:*:*:*:* | 2.4.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.4.1:*:*:*:*:*:*:* | 2.4.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.4.2:*:*:*:*:*:*:* | 2.4.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.4.3:*:*:*:*:*:*:* | 2.4.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.4.4:*:*:*:*:*:*:* | 2.4.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.4.5:*:*:*:*:*:*:* | 2.4.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.6.0:*:*:*:*:*:*:* | 2.6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.6.1:*:*:*:*:*:*:* | 2.6.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.6.3:*:*:*:*:*:*:* | 2.6.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.6.4:*:*:*:*:*:*:* | 2.6.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.6.5:*:*:*:*:*:*:* | 2.6.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.8.0:*:*:*:*:*:*:* | 2.8.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jackrabbit:2.10.0:*:*:*:*:*:*:* | 2.10.0 | Vulnerable | Apache |
- cpe:2.3:a:apache:jackrabbit:2.2.11:*:*:*:*:*:*:* Versions 2.2.11 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.12:*:*:*:*:*:*:* Versions 2.2.12 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.2.13:*:*:*:*:*:*:* Versions 2.2.13 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.4.3:*:*:*:*:*:*:* Versions 2.4.3 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.6.4:*:*:*:*:*:*:* Versions 2.6.4 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jackrabbit:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Apache
Remediation
- Fix · GHSA-9284-j4c9-779q org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.0.6 Advisory →
- Fix · GHSA-9284-j4c9-779q org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.2.14 Advisory →
- Fix · GHSA-9284-j4c9-779q org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.4.6 Advisory →
- Fix · GHSA-9284-j4c9-779q org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.6.6 Advisory →
- Fix · GHSA-9284-j4c9-779q org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.8.1 Advisory →
- Fix · GHSA-9284-j4c9-779q org.apache.jackrabbit:jackrabbit-core (Maven) Fixed in 2.10.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat JBoss Fuse Service Works 6
- Red Hat OpenShift Enterprise 2
Timeline
- 2026-10-02 Threatist record created from CVE-2015-1833
- 2026-10-03 Alias added: GHSA-9284-j4c9-779q
References
Exploit 1
Advisory 5
Other 10
- http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html
- https://github.com/apache/jackrabbit/commit/17e9f68f5a3f05ded20569777a7b07422680612d
- https://github.com/apache/jackrabbit/commit/26e601934d0f439f0a61d62265f52936d79df40d
- https://github.com/apache/jackrabbit/commit/3903739363b79deb7579802fbc27b9b7448218b2
- https://github.com/apache/jackrabbit/commit/6191b366c607e65325a0116097aca8a359b36486
- https://github.com/apache/jackrabbit/commit/89c5c4ed6ab250ad609829517f167d2dbe0abdd0
- https://github.com/apache/jackrabbit/commit/b7fa1ae39641936872617ff95363353b0345b777
- https://github.com/apache/jackrabbit/commit/ddf9a3cd408397d0805917299c4114b09449373d
- https://github.com/apache/jackrabbit
- https://www.exploit-db.com/exploits/37110
More Apache Jackrabbit vulnerabilities
- TI-2023-19328 Apache Jackrabbit RMI access can lead to RCE CVSS 3.1CRITICAL 9.8
- TI-2026-69192 Session hijacking in Apache Jackrabbit WebDAV server CVSS 4.0CRITICAL 9.3
- TI-2016-05842 Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in… CVSS 3.0HIGH 8.8
- TI-2009-00026 Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2… CVSS 2.0MEDIUM 4.3
- TI-2025-33606 Apache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons CVSS 3.1HIGH 8.8
- TI-2026-69193 Apache Jackrabbit DavEx client can instantiate arbitrary classes CVSS 4.0MEDIUM 6.9
Sources
- CVE-2015-1833 · CVE Program
- CVE-2015-1833 · NVD
- FIRST EPSS
- GHSA-9284-j4c9-779q · GitHub Advisory Database · CC BY 4.0
- CVE-2015-1833 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences